Only a few people have access to the keys, plus a set of third parties (think lawyers) that have a shard of an SSS setup. Changing the boot key can be done now and then.

But we think it is feasible to drop the disks entirely for the main servers. So the disk encryption is an issue for the systems holding our CI and imaging platforms.