Comment by jakobdabo

I suggest installing a shell OS (with a neat GUI, no hacker-ish looks) on the Notebook's first partition, the rest (where the main Linux installation is residing) will be encrypted and can be decrypted and booted into only using a USB bootloader with the missing LUKS header (which can be downloaded later using a VPN, for example).