I used to use them, yes. It’s a pretty solid setup, especially like you say, if the tang server itself requires you enter a password to unlock.

A while ago I moved to tpm and secureboot to auto-unlock my servers on boot. It’s definitely slightly less secure, tpm vulnerabilities or a severe enough vulnerability in one of the network services on the machine and a hacker could get into them. But it’s quite a bit more secure than storing the unlock key on usb, and requires at least some degree of hacking skill to break in.

sbctl makes the process of signing boot files pretty easy, systems-cryptenroll for setting up tpm auto-unlock