I am setting up a remote server at a collocation for a client and their primary request is that the data be encrypted beyond the boot partition. The main system will be in a dm-crypt LUKS container on the main drive, but since the kernel could be replaced maliciously in the case of a clear boot partition to capture the key it will also need protection.
In order to satisfy this concern, the only option I can think of is a drive with built in hardware encryption and to unlock it remotely via the IPMI interface. The trouble with this is that the budget for monthly costs has already been approved for one IP address, which means there's no way to easily connect to the IPMI interface without a costly physical access trip, or an even more expensive session with the project manager to increase the budget a few bucks.
What I'm hoping to find is a drive solution that includes a firmware that can be booted to, connected via SSH or HTTPS, unlock the encrypted data and chainload the boot loader which will include a kernel that loads the main LUKS array as the root partition. The interface can be USB or SATA, or even PCI-E.
I'm open to other suggestions, as this is the only serviceable option I can come up with on my own; I just can't find any solutions similar, or a term for this to search for.