Change author here. I think that everything is on-track now. Sorry I hadn't seen any
of these messages before, there's a newer post over here
and I hadn't realised that this had been active. I've posted two scripts over
there too. I'd appreciate any feedback on them.
The only system for automatic decryption with a TPM that I know of is clevis, which
operates in the initramfs for both LUKS1 and LUKS2. I mention it in the change proposal as
a recommendation, but it is by no means a requirement.
While you are correct, I'd rather attempt to prevent tampering and also set-up a
system through which to detect any. Besides, this change proposal is simply meant to offer
security-minded users options that weren't available to them before.