cryptsetup should be in initrd

[osresearch]

This will allow the LUKS headers to be included in the PCRs, as well as record the TPM stored keys into a LUKS key slot.

Downside: it requires an additional several MB of libraries. Can a simpler one be built?

[osresearch]

cryptsetup is now part of the musl-libc built tools and fits easily into the initrd.

[rofl0r]

you probably already know, but if you aim for a static build in the future then linking cryptsetup against libnettle instead of openssl/libressl shaves off almost 400KB from the binary size.