If anyone is tempted to try encrypting their boot partition like I was last week, allow me to save you some trouble.

Yes, GRUB can technically decrypt a LUKS1 partition, but since the kernel isn't running yet, it has to use a standalone (slow) implementation. Takes my laptop 30 seconds to decrypt the boot partition using GRUB, and 2 seconds to decrypt the root partition once the kernel has started (same number of iterations).

I'm planning on replacing this mess with a systemd-boot EFI image and secure boot using my own PK.