TPM2+Tang+Clevis. You’ll need to get really familiar with the TPM registers to properly set something up that will meet specific criteria, but you can make a pretty safe system with Tang that you can enable/disable remotely.