I think encrypting your boot partition and kernel is not very useful. The "better" (IMO), would be to sign the kernel and use secureboot, but otherwise leave it

I think encrypting your boot partition and kernel is not very useful. The "better" (IMO), would be to sign the kernel and use secureboot, but otherwise leave it unencrypted. This way the kernel and whatnot can't be tampered with and you don't have to deal with an encrypted boot partition. I don't think there would be anything in your kernel or bootloader that needs to be confidential!