We have now pretty good LUKS support, but I don't know if we support this use case. I always have `/boot` encrypted as well...
- bug#25305: LUKS-encrypted root and unencrypted /boot w... Jonathan Brielmaier
- bug#25305: LUKS-encrypted root and unencrypted /b... Danny Milosavljevic
- bug#25305: LUKS-encrypted root and unencrypte... Ludovic Courtès