Quack,

My system originally was created as LUKS2 and then I found out GRUB did
not support it and converted it to LUKS1. That was a while ago but that
is to say it's already using PBKDF2 so it's easy to switch back and
forth.

I upgraded my system with the recent release and the signed packaged
came yesterday and now GRUB is properly displaying "2.06".

I had enabled GRUB_ENABLE_CRYPTODISK=y in /etc/default/grub already. I
thus used the Debian installer rescue mode to convert with:
   cryptsetup convert --type=luks2 /dev/nvme0n1p2
I then got into the root fs (via the rescue menu) and issued an
update-grub.
I rebooted and then was dropped into the GRUB shell.

I also added GRUB_PRELOAD_MODULES=luks2 just in case before switching to
LUKS2 but that did not help. For the record while debugging  in the GRUB
shell I got:
grub> insmod cryptodisk
grub> insmod luks2
error: file `/boot/grub/x86_64-efi/luks2.mod' not found.
IIUC it would need to be added to debian/build-efi-images.

I also found out the new grub.cfg does not contain any cryptodisk or
luks* modules, so it seems grub-mkconfig is unable to generate a proper
configuration in this case. I'm adding the working and broken
configuration files as a reference.

My /etc/crypttab:
# <target name>	<source device>		<key file>	<options>
nvme0n1p2_crypt /dev/nvme0n1p2 none luks

Could you give me a hand?

Regards.
\_o<