A Trezor can unlock a LUKS2 volume at boot through systemd-cryptenroll. The PIN is typed on the Trezor itself; the computer never sees it.
This is from reading the Trezor firmware source and the systemd documentation. It has not been tested on real hardware.
- Trezor model: Safe 7, Safe 5, Safe 3 or Model T. The Model One is U2F only and will not work.
- Device PIN: set one on the Trezor. Without it there is no PIN protection at all.