Create a mount unit for your thumbdrive, e.g. foo.mount (see mounts in /run/systemd/generator for examples), e.g.:
[Unit]
...
ConditionPathExists=/dev/disk/by-uuid/THUMBDRIVE
Before=systemd-cryptsetup@ENCRYPTED.service
...

[Mount]
Where=/keys
What=/dev/disk/by-uuid/THUMBDRIVE
Type=ext4
Options=defaults

Important bits there ^ are ConditionPathExists and Before systemd-cryptsetup@

Have two cryptsetup units (again, look into /run/systemd/generator for examples).
First with none, when no flash available:
[Unit]
...
After=foo.mount
ConditionPathExists=!/keys/foo.key
...

[Service]
...
ExecStart=/usr/lib/systemd/systemd-cryptsetup attach 'storage' '/dev/disk/by-uuid/e1ed67cf-6eee-4cbf-af31-25fb9b3f20c6' 'none' 'luks'
...

Another one opposite:
[Unit]
...
After=foo.mount
ConditionPathExists=/keys/foo.key
...

[Service]
...
ExecStart=/usr/lib/systemd/systemd-cryptsetup attach 'storage' '/dev/disk/by-uuid/e1ed67cf-6eee-4cbf-af31-25fb9b3f20c6' '/keys/foo.key' 'luks'
...