All right, I think I have some better idea about the true nature of
GRUB_ENABLE_CRYPTDISK. According to the Arch Wiki: Boot partition
GRUB can be set to ask for a password to open a LUKS blockdevice in order to
read its configuration and load any initramfs and kernel from it. This option
tries to solve the issue of having an unencrypted boot partition. /boot is
not required to be kept in a separate partition; it may also stay under the
system's root / directory tree.
To enable this feature encrypt the partition with /boot residing on it using
LUKS as normal. Then add the following option to /etc/default/grub:
/etc/default/grub
GRUB_ENABLE_CRYPTODISK=y
Note: GRUB_ENABLE_CRYPTODISK=1 will not work as opposed to the request shown
in GRUB 2.02-beta2.
Be sure to #Generate the main configuration file while the partition
containing /boot is mounted.
Without further changes you will be prompted twice for a passhrase: the first
for GRUB to unlock the /boot mount point in early boot, the second to unlock
the root filesystem itself as described in #Root partition. You can use a
keyfile to avoid this.
I think that GRUB_ENABLE_CRYPTDISK gets rid of the need for /boot them. You
just put GRUB_ENABLE_CRYPTDISK=y in the file, reinstall GRUB, and delete
/boot from the /etc/fstab file.
Nasty stuff this.
