I really don't know, to be honest. TPM is one option. They should be pretty reliable--if not then you'd have Windows users kissing their encrypted disks goodbye

I really don't know, to be honest. TPM is one option. They should be pretty reliable--if not then you'd have Windows users kissing their encrypted disks goodbye, right? Another option (in my case) would be using FreeIPA's vault service to stash the key. It would be pretty easy for malware to grab the key though. Perhaps some setup where both a key owned by the user and a key owned by the host, with access mediated by sssd could be designed... (And admittedly for AD users it's no good since they can't use the vault service...) It feels like AD is missing some kind of secret storage service for users to make use of.