Ah, ok. I was using 3.2.20.1, I will try the experimental branches.
> I think it should work ("should", because the crypto stuff is still somewhat
> untested) if you change the sda2 definition to
>
> primary -:encrypt 4096- --
>
>
> This is only true, however, for the experimental builds; please see
> http://faiwiki.debian.net/index.php/Main_Page#getting_FAI for more
> information.
> The crypto-patch will probably still be kept in there for another release or
> so
> to receive more testing. As such, any kind of feedback is most welcome!
>
> Best,
> Michael
>
>