Is it possible to remove the encryption key from the filesystem?

[flixman]

I am playing with ZFS on debian 11.0, and I am facing a question I cannot answer: if I create a pool like

zpool create [....] -O encryption=aes-256-gcm -O keyformat=passphrase -O keylocation=prompt [....]

and then I add a TPM to the system and I want to keep the encryption key stored on the TPM, is there any way to find out which is the current encryption key (the real one, not the wrapping key) and to remove it from the ZFS storage? I am thinking on a scenario in which somebody gets their hands on the disk, with enough computational power to do a brute force on the key... if the key is not at all in the disk, because is in the TPM, this attack is not possible anymore... right? if that is possible, then the TPM could deliver the key to a file in ram, upon successful authentication.