Is it possible to encrypt the boot partition on Qubes OS and use a detached header for the main disk?

[FranklyFlawless]

Refined USB Boot: Using a Minimal "Hardware Key" for Encrypted /boot and Detached Headers

Quick Overview For the past few months, I have been using this setup. It remains a solid choice: storing an unencrypted /boot and a detached LUKS header on a USB drive keeps the internal disk encrypted without metadata. However, it has some friction. I have to manually mount /boot before updating dom0 and remember to unmount it before rebooting or restarting sys-usb (e.g., during a template upgrade) to prevent the system from hanging. Another setup makes /boot both encrypted and detached (stor…