You need to have a threat model. Then work out a solution from that. Ask yourself, why are you encrypting the hard drivers ? One threat model might be: Burglar

You need to have a threat model. Then work out a solution from that. Ask yourself, why are you encrypting the hard drivers ? One threat model might be: Burglars sneaking in during the night and stealing the hard drivers. Then you would store the keys on a different location then the disks. Then you make it a routine to reboot parts of the fleet, like scheduled simulation/training so that everyone knows what to do when you actually need them.