Comment by nuker

> combined with LUKS, TPM keys

Does it work? Server can reboot and use TPM to unlock rootfs? What about /boot - encrypted and tamper proof? Resists evil maid attack?

Rabbit hole, I know, but so fascinating if you solved it all :)