Comment by DrillShopper

> The cryptsetup, cryptenroll, unified kernel images, kernel signing and systemd-boot work nicely together.

This has not been my experience across Debian and Arch