@HerraBRE unlocking of LUKS root partition can be done directly in initramfs:
https://neilzone.co.uk/2021/06/unlocking-a-luks-encrypted-partition-via-ssh-on-debian-10-and-debian-11/
I use a version of this on a bunch of servers.
But yeah, it needs network access, obviously.
Anyway, whatever works. I am probably overdoing it with this. 😅