Integrate with Ultrablue for remote attestation over Bluetooth/USB

Nobody has claimed this yet.

This issue is intended as a discussion to decide whether the following is an idea worth pursuing or not.

**Is your feature request related to a problem? Please describe.**

It would be nice to be able to have disk decryption gated on remote attestation working: instead of checking a TOTP on your phone, have your phone send a decryption key to the laptop if and only if PCRs match their expected values.

**Describe the solution you'd like**

A way to make this happen for personal users using their phone is Ultrablue: https://github.com/ANSSI-FR/ultrablue

**Describe alternatives you've considered**

I've been told VaultBoot does something similar using a server running on a RPi: https://github.com/hardenedvault/vaultboot

I haven't tried to use it myself. The upside of the VaultBoot approach is that you don't need to fit an entire Bluetooth stack in your initramfs (including dbus). A downside is that the user needs to own and setup a RPi rather than a mere smartphone.

**Additional context**

- FOSDEM presentation about Ultrablue: https://fosdem.org/2023/schedule/event/image_linux_secureboot_ultrablue/
- Precompiled binaries: https://github.com/ANSSI-FR/ultrablue/releases/

This is an open design discussion rather than an implementation task. Start by reviewing the Ultrablue and VaultBoot links, then examine how the project currently handles disk decryption, TOTP, PCR checks, and initramfs constraints. Done would be a maintainer decision on whether remote attestation over Bluetooth or USB should be pursued and what approach to take.

Written by the indexing model from the issue text.