[naikrovek]

not without requiring PIN entry upon boot.

TPMs are external to the CPU and traffic to and from them can be intercepted and used to decrypt the disk.

there was an article on that exact situation a few weeks ago, right here on HN.

https://news.ycombinator.com/item?id=29258879

[josephcsible]

I meant ordinary full-disk encryption with a regular passphrase and no TPM in the picture at all.