This patch for genkernel adds support for connecting to a machine using ssh before the root filesystem has been mounted in order to supply a luks volume password:

https://github.com/ebast/genkernel/commit/319512ba55af7a0e875972173cc92563b6ce5b37.patch

It avoids having to log-on a remote KVM session to provide disk encryption passwords in the case of servers. That is quite useful.