Server 1 has an encrypted boot drive

Server 2 has the decryption key

Server 1 boot loader can authenticate to the remote server 2 and retrieve the key.

Q) What is the best thing server 2 can be?

An HSM probably but with a sensible budget?

A password manager server?

Some sort of enclave?

Something better?