Comment by shaky-carrousel

No, I'm asking for what LUKS has done for two decades. Keyslots are alternatives, not requirements, so a TPM slot and a passphrase slot coexist and either one alone unwraps the master key.

BitLocker does the same with key protectors. Even on a local account with no internet, there's always a 48-digit recovery password that opens the volume on a completely different machine.

Two of the three major platforms ship a portable passphrase path alongside the hardware one, so this being unavailable here is a product decision, not a law of key derivation.