The frustrating flaw in these setups is disk integrity. It’s pretty consistently {speed, integrity, mutability}, choose two. Dmcrypt, dm-integrity, and dm-verity cover all the pairs, but none of them completely solve the problem. If you have fairly static configuration, I imagine you can set up a blend of, say, dm-verity (for binaries/static files) and dm-integrity (for mutable files) and get something workable.

Caveat: I seem to recall dm-integrity being somewhat flawed and vulnerable to rollback.