You can use a yubikey to do it. It can work in challenge/response mode, so the yubikey is required to unlock the device. That's good for laptops.

You can also use a private gpg key and an gpg-encrypted keyfile. Yubikey can store gpg keys (with attestation if you want), and you can enable both yubikey access and gpg in initramfs. That's good for servers if you pair it with initramfs sshd.

TPM is kind of broken, as I understand it, so I didn't even bother looking into it. There's really no reason I can't carry my keys on my physical keychain, so I don't see a need for TPM. I can also put a USB stick on my keychain and use that to boot.

That way even if an attacker has physical access to the hardware, it would be require some really advanced firmware/microcode hackery to compromise the machine.