Network-Bound Disk Encryption (NBDE) using something like clevis / tang can be used or a sealing the luks passowd in a TPM.