does it support encrypted /boot though?