Install Qubes OS with boot partition and a detached LUKS header on USB

[apparatus]

@robertford

If I understood you correctly your setup creates a block device /dev/sda with encrypted data which provides more or less plausibly deniability. The famous wrench taken out of the equation. Does /dev/sda hold a partition table?

Yes, it’ll be a /dev/sda device without partition table.
But since TRIM is enabled there may be some security implications:

@taradiddles

There are some security implications to permitting TRIM (read for example this article ), but in most cases not exploitable. Conversely, TRIM can improve security against local forensics when using SSDs, because with TRIM enabled deleting data (usually) results in the actual data being erased quickly, rather than remaining in unallocated space indefinitely. However deletion is not guaranteed, and can fail to happen without warning for a variety of reasons.

Disk Trimming
So you may want to disable TRIM.

@robertford

In my eyes your setup also adds another layer of security as the boot partition is a weak spot in all linux distros. Most distros don’t encrypt the boot partition and don’t cryptographically sign the files on the boot partition. It’s just the kernel, the modules, the initramfs and the EFI boot blobs, so what could possible go wrong?

Yes, it can protect the /boot and /boot/efi from malicious modifications in some cases.
But if you’re using USB disk with the same USB controller attached to sys-usb that you use to connect some untrusted USB devices then it’s possible that some malicious USB device will compromise sys-usb, write malicious firmware in USB controller and restarting disposable sys-usb won’t get rid of it and this malware in the USB controller firmware may then modify the files on your boot USB disk that you connect to it.
Also unlike Anti evil maid or TrenchBoot, it won’t protect against malicious EFI firmware.