Use a passphrase. Or use a yubikey, like a sibling mentioned. I wouldn’t decrypt my secret partition on untrusted devices, conversley, if I already have a trust

Use a passphrase. Or use a yubikey, like a sibling mentioned. I wouldn’t decrypt my secret partition on untrusted devices, conversley, if I already have a trusted machine, why bother with encrypting the secrets if they can just be sniped when I mount my partition? Regular file storage for secrets is really a bad solution - use a yubikey or a secure enclave.