Ask HN: How would you implement key escrow for FDE on a Linux workstation?

I'm looking into what it would take to implement key escrow/recovery with full disk encryption on a series of workstation laptops. The laptop software image will be based on Xubuntu 16.04, so basically Linux + xorg + xfce4. The plan is to deploy everything with /home/ as its own encrypted partition.

Ordinary passphrase based FDE isn't sufficient in this case as we need the ability to recover the contents of a company-owned laptop in the event that a person refuses to give up the passphrase and goes rogue, gets fired or for a variety of legal/regulatory reasons. Has anyone implemented something like this for a corporate Linux workstation environment?