If you didn't have an initramfs, you could do it with kernel parameters. Just add a random string as kernel parameter and then use
/proc/cmdline as the key for your encryption. If it's not easy to add such parameters to your boot loader, the Linux kernel has a
CMDLINE config option that lets you compile it in. (Note: it is possible for kernel parameters to end up in log files and such. Whether it's suitable for your scenario depends on what is running on / writing to your SD card.)
With initramfs, of course you're free to do whatever you want. It can ask for your passphrase at bootup, or include a key, or do both using encrypted keys. It's up to you but the exact implementation depends on what your initramfs looks like without such modifications. You can look at various initramfs guides online to get an idea of how it works in principle, for example: https://wiki.gentoo.org/wiki/Custom_Initramfs
You just have to be careful to not leave an unencrypted copy of the key on the SD card itself. At the same time you should have a copy somewhere since it may be hard to get it back out of the NAND if the device ever breaks.