Just to confirm I can use a gpg key or one time pad and then use a squashfs on the 32gb to boot off? sure that is the case but total drive encryption off a key with squashfs has to be this nitrokey as well? options otherwise will be considered for Luks on gentoo.