Reddit - archlinux - Detached LUKS header full disk encryption with encrypted keyfile inside a passphrase-protected bootable keydisk using direct UEFI secure boot, encrypted swap, unbound with DNSCrypt and DNSSEC, and system hardening https://www.reddit.com/r/archlinux/comments/7np36m/detached_luks_header_full_disk_encryption_with/