With LUKS you can enroll an extra auth option in addition to TPM, like a password or a FIDO2 token.