Setting a TPM Disk Unlock Key fails without error and is not user friendly.

Nobody has claimed this yet.

To fix:
- Initial setup of disk unlock key setups kexec_key_devices.txt
- We can use cryptsetup to check for all blkid and check if we have a LUKS header and suggest those devices automatically so the user only enters it once, to be saved to be reused.
- That file contains encrypted devices/encrypted LVM(still not tested on my side)
- That is, /dev/sdaX UUID in case of encrypted devices
- Next runs should not ask again to
- setup Encrypted LVM group if not defined under that file
- setup Encrypted devices
- It should actually prompt user to reuse already defined key devices under kexec_key_devices.txt and simply reuse them if user accepts
- Note that if Disk Recovery Key (passphrase should be added here) entered is bad, it will silently fails and go back to boot selection when trying to set a Disk Unlock Key, instead of looping, or at least stop so user can read error.
- Note that initial setup of TPM Disk Encryption Key is bad:
- `Do you wish to add a disk encryption to the TPM` is just a wrong sentence, missing `key` and should be `TPM Disk Encryption Key and passphrase`. Otherwise we are training users to mix keys and passphrases and its already complicated here. If not ok with glossary, we should modify glossary, otherwise we have no clue what we are talking about. I will also move glossary terms with Capitals.
- On booting default, the user is asked to `type unlock password`. Those should be the same and should be TPM Disk encryption Key passphrase (because it's what is asked here, not the key) and setting it up should prompt to setup a TPM Disk Unlock Key, and ask for passphrase, not password.
- I thought we all agreed that the coined term was TPM Disk Encryption Key, which is too long, and should be TPM Disk Unlock Key and TPM Disk Unlock Key passphrase. While the glossary is naming [TPM encryption key](https://osresearch.net/Keys/#tpm-disk-encryption-key). So to not change anything, the prompt will be changed to `TPM Disk Encryption Key passphrase`.

Additionally, for traces:
- Show boot options silently fails if signature check fails, going back to menu

Begin with kexec_key_devices.txt and the cryptsetup/device-discovery flow described in the issue. Review the TPM Disk Encryption Key prompts, passphrase handling, and the signature-check path for silent failures. Done means reuse of accepted configured devices, visible handling of bad keys and signature failures, and consistent prompt terminology.

Written by the indexing model from the issue text.