Enroll a TPM2 security chip (only secure-boot-policy PCR) and require an additional alphanumeric PIN
systemd-cryptenroll --tpm2-device auto|path/to/tpm2_block_device --tpm2-with-pin yes path/to/luks2_block_device