Also possible without a TPM: you just put openssh into the initrd, so you can log in and type the password to unlock the root.
(It's technically not full-disk encryption because the kernel and initrd are in plaintext, but everything else is)
(It's technically not full-disk encryption because the kernel and initrd are in plaintext, but everything else is)
With the TPM you can fully disable password auth over SSH.