HP ThinPro 8 and 9 encrypt the root partition with LUKS and seal the key to the TPM. This is meant to keep the data safe if an attacker gets physical access to the disk. It does not, due to a rather large gap in the measurement of the boot chain.

Examining the boot loader showed the TPM seal only binds the key to PCRs that measure the BIOS, the option ROMs, and the GRUB binary. That trusted GRUB binary then loads a kernel and an initramfs that nothing measured at all. So I edited the script that unseals the key and told it to write the key out to the unencrypted partition. On the next boot the TPM released it to my modified code. No soldering, no reverse engineering, no exotic anything.