Encrypting /boot is in fact feasible

[lfit]

Encrypting /boot is in fact feasible

[ilkkajylha]

There is no need to enter password two times, if you are using keyfile. The encrypt hook can take the file specified in the cryptkey kernel parameter and use it to unlock the cryptdevice.

http://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/

[zaolin]

Yep, that's possible by building grub2 with cryptsetup support. The smarter solution is to enable lvm support in grub and using the boot partition as logical volume so that the whole partition in one cryptsetup volume which encloses the lvm physical volume.

If shim protects the grub2 efi module it should be also possible to establish a secure boot.
But keep in mind you have to enter a password two times because of grub2 which can't pass the key to the linux kernel.

Regards Zaolin