I looked into the options and the best I feel available is separate /boot on a USB key AND wrapping that key inside a tiny LUKS volume, so you need the key insi

I looked into the options and the best I feel available is separate /boot on a USB key AND wrapping that key inside a tiny LUKS volume, so you need the key inside of it and a password, which is poor man's two-factor for booting full-disk crypto. https://bbs.archlinux.org/viewtopic.php?pid=1502651#p1502651 https://bbs.archlinux.org/viewtopic.php?pid=1502651#p1502651 But as I know LUKS and other disk systems in Unix decrypt, and do not MAC then encrypt, I wonder if I am wasting even more of my time I do not have to begin with.