Reinserting the expansion card and rebooting always brings up it’s grub menu again.
I am not using a bootloader. I’m registering the kernel directly with efibootmgr. With a suggestion from a friend and this hint I have figured out that the BIOS will see and boot an EFI executable in the default location EFI\BOOT\BOOTX64.EFI. I’ve managed to compile a kernel that doesn’t need an initramfs and has the cmdline built in, placed it in that location, and now even if all other entries are removed I can boot this kernel as the BIOS finds it. That at least gives me a backup/workaround to boot when all the other entries disappear.
I suppose my first question is, do you also have your EFI partition encrypted?
I’m using the self encrypting disk feature, so the disk itself handles all encryption in hardware. Once the BIOS supplies the password, it’s visible as a normal disk. So it does seem similar to your situation. I guess it could be different in that perhaps the disk controller still shows up, but I’m not certain. I can take a deeper look by booting to USB when the NVMe drive is still locked and see if /dev/nvme0 shows up.