Can I hide my password for data at rest encryption key? For MariaDB encryption at-rest, my setting is
[mysqld]
# at-rest encryption
plugin_load_add              = file_key_management
file_key_management_filename = /etc/mysql/rest/keyfile.enc
file_key_management_filekey  = FILE:/etc/mysql/rest/keyfile.passwd
file_key_management_encryption_algorithm = AES_CBC

However, if hackers steals the database, they has access to both keyfile.enc and keyfile.passwd and the point of encryption at-rest is useless.
Can I tell the key manager not to read the super password from the file. Instead, read it from the user at the startup?
Usually database is started as a service in background, so entering keys at startup will not be possible.
To separate key(s) and data you have the following options:

store keys on a separate device which can be unplugged after start of database server.
use an external key management system, e.g Eperi which also supports key rotation.