One thing of note here, don't put LUKS header on any kind of flash (like SSD) or SMR HDD.
Why not?
If the system is interrupted after data is deleted there is a good chance you can still get it back.
On a normal HDD you still have to wipe the data (ie. physically overwrite it half a dozen times). But this is not possible to execute reliably on SSD or drive-managed SMR HDD.
[0]: https://wiki.archlinux.org/title/Securely_wipe_disk#Flash_me...
Reversibility is not a feature of destruction, lexically-speaking. A better description might be "locked".
More importantly in this case: if you are able to reverse it, you can be compelled to reverse it. This is no different than having a secret passphrase.
An interesting way of strengthening such a system is to split the recovery code between multiple people in multiple jurisdictions. Convincing them to hand over their piece of the key could require various levels of proof-of-free-will, ranging from "Hey, I need those numbers on that piece of paper I gave you" (asked on a video call, in a public park) to "I've booked a flight and I'll meet you at the agreed place next Monday at the standard time".
These approaches can be combined with a protocol of "If I use the duress phrase, then give me a fake key and then send a message to the other members of the group / the public / the media that I've been compromised". Of course this sort of system assumes you are part of a wider organisation or at least have friends you can trust to implement all this opsec securely, without adding to your risk profile, but for some people this will be viable.
This script itself was actually an easter-egg in the explainer video at 50 seconds :P
* https://youtu.be/S3LtLyuaBvI?t=46
We're just finishing a very detailed write-up on the "LUKS Header Shredder," and we'll be publishing it in ~2 weeks. You can subscribe to our newsletter on our website (buskill.in) or crowdsupply.com for updates :)