Enroll a TPM2 security chip (only secure-boot-policy PCR) and require an additional alphanumeric PIN
systemd-cryptenroll --tpm2-device {{auto|path/to/tpm2_block_device}} --tpm2-with-pin yes {{path/to/luks2_block_device}}