LUKS can use a central recovery key.
Regular users can't mess with LUKS settings.
Regular users can't mess with LUKS settings.
> a more enterprise solution where I can store a recovery key centrally that a user can’t remove.
The enterprise solution is to not give users administrative privs.