It seems like the two main LUKS encryption options are:

1. USB keyfile (see <https://superuser.com/questions/149578/how-can-i-use-a-keyfile-on-a-removable-usb-drive-for-my-encrypted-root-in-debian>)
2. Typing in a password

These both have weaknesses. The first can be overcome by stealing the USB drive. In the second case, a keylogger could be used, or I could be forced to give over the password.

Would it be possible to create an encryption scheme that required both of the options? Then, if I was given an injuction to provide the password, I could destroy the USB drive (e.g. burn it on the stovetop); conversely, if someone stole my USB drive, they would need to get my password as well.

It seems the existing LUKS key slot idea is that providing a key for *any* key slot will unlock the device, not that one has to provide a key for *all*, or say "2 of 3" key slots (iirc the latter can be accomplished in a cryptographically secure manner using a Galois field).

(Also, I happen to be on an OpenSuSE system, so please keep answers distro-agnostic or something that can work on SuSE.)