Edit: consider unencrypted /boot There was a case here. If no other constrains, systemd-boot seems to be better for LUKS.