Thanks for the link; I hadn't heard of Mandos. Another solution in the same space is Clevis[1]; last time I was researching this problem, I came across it via

Thanks for the link; I hadn't heard of Mandos. Another solution in the same space is Clevis[1]; last time I was researching this problem, I came across it via Red Hat's docs[2]. [1]: https://github.com/latchset/clevis https://github.com/latchset/clevis [2]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening https://access.redhat.com/documentation/en-us/red_hat_enterp...