@10tklz unless cross-platform support is an issue, I'd just go with the native dm-crypt stuff. Unencrypted /boot is NBD...