FR: Use Trezor's GPG capability to decrypt LUKS keys

Nobody has claimed this yet.

Trezor apart from being a bitcoin wallet provides GPG functionality. I think there are major pros of the device compared to Yubikeys:

- Open hardware/software.
- Keys are derived from the mnemonic, which can be remembered. In case Trezor is lost it's easy to recover the keys.
- It's protected by a pin code and an additional passphrase (which is used with the mnemonic stored on the device to generate a new key space). Just stealing the device is not enough. The pin code is much harder to shoulder surf.

It would be amazing if it could be used to decrypt LUKS keys instead of using TPM.

Trezor Bridge is written in go, and could potentially be just compiled and included as a part of heads build. This service starts a HTTP server to provide API to communicate with Trezor. Unfortunately, the other piece — trezor-agent (https://github.com/romanz/trezor-agent) uses Python, which I am not certain could fit in heads installation. Trezor-agent doesn't require the bridge, but will use it if service is found.

There might also be a completely custom solution using Trezor without GPG directly.

Start by reviewing the proposed Trezor Bridge and trezor-agent approaches described in the issue, including their communication and runtime requirements. Determine a concrete integration scope for Heads and define completion around decrypting LUKS keys through Trezor without relying on TPM.

Written by the indexing model from the issue text.