Support for remote (when only public key from the target TPM is available) secret sealing and consumption of the remotely sealed data was added to systemd-cryptsetup/systemd-cryptenroll, see https://github.com/systemd/systemd/pull/28519 and its pre-requisites:

• https://github.com/systemd/systemd/pull/29234
• https://github.com/systemd/systemd/pull/29183
• https://github.com/systemd/systemd/pull/29426
• https://github.com/systemd/systemd/pull/29427

The functionality is needed for RHEL on Confidential VMs on Azure where root volume is pre-encrypted by Azure infrastructure. Currently, RHEL uses a downstream-only solution:

• https://gitlab.com/vkuznets/tpm2-luks-import
  which we'd like to get rid of.