For years I've used https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis and https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.