Comment by davb

To counter some of the (valid) privacy concerns around TPM unlocked FDE, one big benefit is when it comes to decommissioning physically secure machines. If you aren’t concerned about the evil maid scenario and have reason to avoid network based unlocking, TPM unlocked FDE keeps your machines remotely rebootable while still allowing you pull a disk and send it for secure shredding at server EOL. That is to say, if your scenario is “encrypted at rest on a physically secure and trusted server” (more concerned with the storage medium alone), it’s a good fit. It means you’re not reliant on the OEMs opaque secure erase functionality.