I didn’t know about the tang and clevis packages - thanks for that! For the decryption itself, it’s possible to set it up by methods like https://openwrt.org/docs/guide-user/storage/disk.encryption or the tang/clevis way.
I’m going to attempt using this setup for now, also hoping it doesn’t break with a future update, since what I’m about to do is undocumented at best.