It's actually possible to suspend io to the encrypted data and remove the keys from ram and prompt for the passphrase at resume to unlock.

Check out go-luks-suspend