/boot
contains the basic/initial BOOT configuration of your system... that
means, by definition, it must be discernable---and thus cannot be
encrypted. Without an un-encrypted /boot partition, there isn't
sufficient intelligence for the physical computer to get booted up.