A theoretical setup where the encryption key is in the initramfs. You are encouraged to put /boot on a separate USB stick, or if you know what you’re doing, make sure you’re using classic HDDs, where you can safely erase the key on decommission.