Grub can actually handle booting from an encrypted ext4 root as well, no /boot needed. You do end up entering the password twice by default, but that can be dea

Grub can actually handle booting from an encrypted ext4 root as well, no /boot needed. You do end up entering the password twice by default, but that can be dealt with by using a key file. Lots of blog posts out there with instructions to convert existing installations, for example http://dustymabe.com/2015/07/06/encrypting-more-boot-joins-the-party/ http://dustymabe.com/2015/07/06/encrypting-more-boot-joins-t...