Apple solves the problem in hardware by streaming the persistent storage data through dedicated silicon. Not only is this extremely fast, it guards the key. For the Intel versions of Mac, this was done in the T2 coprocessor.
(And if anything else on your motherboard dies, Apple's official answer is "you're f*cked", since they refuse to do board-level repair.)
For the threat model of most users, where hardware-based targeted attacks aren't a big concern, this is a bad tradeoff.
I've heard of zero T2s dying. I've hard of android data recovered (TFA)
Cloud is a great solution for most people. But not really an option for "where do I put my decades-stale collection of old home directories" or "mbox files from email in the late 90's".
> hardware-based targeted attacks
You mean physical-access attacks, correct? Is it really just these kinds of attacks that a T2 chip protects against?
AFAIK if malware has super user privilege, it can access the RAM of other processes, and therefore it can access the encryption keys stored in RAM by other processes.
If those processes could have used an encryption API that does the encryption on the chip, and therefore not need to store encryption keys in RAM, they'd be protected against this kind of attack, a kind of attack that is not hardware-based.
Given how fast networks and storage and processors are these days - if something takes more than an hour or two of diagnostic time and rarely happens, you just nuke the machine and re-image.