"still, is there a point to keep /boot encrypted?"
An unencrypted boot partition opens the possibility for someone to be able to
install malicious software, since it can be read from and written to without
any problem. Perhaps they'll replace the kernel with a modified version
containing a keylogger that makes note of the passphrase that you type in
while decrypting the rest of the drive. Which the kernel then saves somewhere
for that person to get later. Or perhaps transmits to them somehow. Or who
knows what else? The point being it opens a (potential) avenue of attack.
Whether or not that's an issue for you depends on your threat model.
"One funny sounding variation I've heard about is you can have the /boot on a
thumb drive. I believe that way the computer won't boot without it."
This could be a good option for computers that don't support libreboot and
can't have an encrypted /boot (since proprietary BIOSes typically do not have
support for reading an encrypted /boot it needs to be left unencrypted.) This
can avoid the whole issue I mentioned above (because you could keep the USB
thumb drive with you at all times even if not the computer.)
If someone isn't using encryption for the rest of the drive there is very
little point in putting /boot on a different drive because even if someone
can't boot the drive itself that doesn't stop someone from booting the
computer using their own CD or USB stick and then mounting the HDD. Or from
removing the HDD from the computer and mounting it on a different computer.
And then, they have access to everything. So putting /boot on a different
drive only makes sense when disk encryption is also used (and if the computer
supports libreboot and can have an encrypted /boot there isn't anything to be
gained by putting /boot on a different drive because you don't have
unencrypted stuff you're trying to save from unauthorized changes or reading.
"No idea how to do it though or whether it's super safe or anything."
You'd do custom partitioning in the Trisquel installer. Just as you can say
in the installer that /home is to be located on a different drive, you'd put
the /boot partition on a separate thing too (possibly a USB stick.) So you'd
need the thing that is to hold /boot to be connected while doing the install.
