I wonder how you would block bruteforcing the encrypted storage. Once someone got their hands on your device for long enough to clone, you’re done and you get into the “how much is the data worth to you” territory.
And it better be worth a lot because bruteforcing LUKS? Good luck. I wonder if even the NSA would be capable of that.
There are issues with booting from unencrypted storage but that isn’t really a LUKS issue, though.
TPM has shown to be quite vulnerable as well, with for example the usually hardware flaws where, IIRC, TPM would sent the security certificates in plan text over data lines somewhere.
Either way, I don’t see my of these items as something great that LUKS doesn’t have.
boredsquirrel