Add systemd-cryptenroll support

[unforgivablesin]

Desired Feature

I would like to have the option to configure systemd-cryptenroll on a LUKS encrypted volume. The reason I am in favor of systemd-cryptenroll instead of clevis is that I can use my TPM + a manual PIN. It seems Clevis is not capable of this.

[jlebon]

Ahh yes, that's latchset/clevis#52 it seems.

Not really the answer you're looking for, but you might be able to get this to work by just having your Ignition config set up a TPM2 pin, but then have a systemd service on first boot remove the clevis pin and replace it by systemd-cryptenroll.