There is an upstream patch to retry the passphrase. It may be worthwhile to backport the patch. https://git.savannah.gnu.org/cgit/grub.git/commit/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c