Is that true full-disk-encryption?

[Y0HO]

├─sda2 8:2 0 550M 0 part /efi
├─sda3 8:3 0 200M 0 part
│ └─cryptboot 254:0 0 198M 0 crypt /boot

So /efi is still unencrypted, would it be possible to install it on a usb stick?

[Thann]

Not exactly, but It's what the arch-wiki calls full-disk encryption. I was planning on adding a step that sets up SecureBoot to ensure nothing in the EFI has changed. Unfortunately, that is made harder by the complication of this bootloader setup, so I might hard-fork the boot setup =/

[Y0HO]

@Thann https://bbs.archlinux.org/viewtopic.php?pid=1162437#p1162437 Post number 8

I think it will be easier to put /boot on an external device then to modify the SecureBoot via a bash script

Also there is some info in the Arch wiki about it: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system