Is your feature request related to a problem? Please describe.
I'd like to be able to use both a TPM2 sealed secret and a passphrase to unlock encrypted volumes. The TPM enhances security by making the volume passphrase uncloneable and high-entropy, but if e.g. a laptop is stolen, the volume may end up accessible with no further hurdles. An additional passphrase can help remedy this with very little overhead. Passphrases with low entropy (e.g. a numeric PIN) can be feasible here due to the TPM2 dictionary attack lockout mechanism.

Describe the solution you'd like
I'd like to add an optional --tpm2-auth parameter to systemd-cryptenroll and systemd-cryptsetup which adds a password prompt and includes this password in a TPM2_PolicyAuthValue component to the HMAC secret policy. In this case the policy might be a PolicyAnd(PolicyAuth, PolicyPCR).

Describe alternatives you've considered
With the current choice of tpm2 and passphrase authorization, one can have either the "something you know" or the "something you have" kind of authorization, but not both at the same time. FIDO keys are similar in this regard. There is currently no way I know to achieve this 2-factor model. This change would be a simple and backward-compatible way to allow both.

The systemd version you checked that didn't have the feature you are asking for
248

I'm working on a PR for this change, but would be happy to receive comments and guidance.