This introduces what has been described in
https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html.
That is: support for FIDO2 and recovery passphrases and their boot
mechanism.
Testing is hard right now because of canokey-qemu being broken and U2F
is not a valid replacement for FIDO2…
I tried to keep as much as possible the previous behavior and make it
possible to mix FIDO2 and normal passphrases or key files without any
problem.
PIV support is out of scope for this change but can easily be added.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Raito Bezarius
b02541f2d0