To be fair, once you have the device in your hands you can do other nastiness as well such as loading a modified initramfs (such contains cryptsetup) that inter

To be fair, once you have the device in your hands you can do other nastiness as well such as loading a modified initramfs (such contains cryptsetup) that intercepts the entered key and writes it somewhere. This part of the boot system is normally not encrypted as it's the very step that asks for the passphrase. Good 'evil maid' mitigations should be sufficient here too, like encrypting at the SSD level with a boot password. However I do wonder if this bypasses secure boot checks as I doubt the Luks header is signed. That's normally an evil maid mitigation but I don't think it'll suffice here.