Not entirely wrong, but may be missing how the key is now exportable adding risk to the scenario. As you mention decryption key is provided automatically to th

Not entirely wrong, but may be missing how the key is now exportable adding risk to the scenario. As you mention decryption key is provided automatically to the system. This means it's in RAM ready for export and re-use by bad actor against your encrypted disk. Cold boot attacks[1] are one of the attack vectors you'd want to read more on to figure out if this is valid for your threat model. [1] https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack