Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there anything the end user could do? Like some configuration options?
In some countries there are key disclosure laws and in case plausible deniability would be possible you could just claim the dog ate it. They probably still won't believe you, but anyways.