I have automated it with a small initramfs script which has half password and download the other half from internet. My threat model is to protect from a random thief. So they should connect it to a network similar to mine (same netmask and gateway) and boot it before I can remove the half key from internet.

some security which is on my TODO list is: allow fetching the half key only from my home IP and add some sort of alert for when it is fetched.