look at integration with hardware encryption

such as tpm

Alternative Architectural SolutionsBecause a standard SSH login cannot pass a decryption secret, you must use one of these alternative architectures to securely store and retrieve platform credentials on a headless server:TPM 2.0 and Systemd-Credentials: You can store encrypted credentials or access tokens directly on the server's filesystem and protect them using the hardware Trusted Platform Module (TPM 2.0). Tools like systemd-creds encrypt data to the specific hardware posture (PCR states). The system can automatically access these credentials at runtime without needing a password from the SSH user.SSH Agent Forwarding: Instead of storing the secure keys or secrets on the headless server, store them locally on your client machine. Enable SSH Agent Forwarding (ssh -A) when connecting to the server. Your server applications can then securely query your local agent to sign requests or authenticate, meaning the platform storage never lives on the server disk.Vault Services (Vault/sops): For applications running on the headless server, retrieve secrets dynamically from an external vault like HashiCorp Vault or use sops to decrypt configuration files at runtime. The decryption keys can be injected safely via environment variables or managed system identities.PAM Password Authentication: If your workflow permits it, switching your SSH authentication back to standard password-based login (over a secure network) will allow the Pluggable Authentication Modules (pam_sepermit or pam_keyring) to automatically catch your plaintext password and unlock the system keyring upon login.To help narrow down the right solution, tell me:What specific application or secret (e.g., API keys, database credentials, SSL certificates) are you trying to protect?Is this for an automated background service/cron job, or for interactive commands you run manually after logging in?

Start by reading the existing encryption and decryption implementation and its RSA/passphrase-protected key handling; no file or test is named in the issue. Clarify which secret is involved and whether the use is interactive or automated, then define the selected hardware-backed integration and its acceptance criteria.