https://www.golinuxcloud.com/network-bound-disk-encryption-tang-clevis/

something like clevis/tang might help but ultimately if someone has physical access to your box then they can potentially get it all anyways 🤷