Hello,

I just spent a couple of hours helping someone in my family on
debugging a "weird" issue. He was switching his rootfs to a different
filesystem and for unknown reason the crypto broke.

We figured out later that the way how the OS was installed before is NOT
compliant to the current convention in Debian Stable. Basically, what
you use is a file called encrypt_hook. Problems here are:

a) that file is copied SILENTLY into the hook folder. The origin is not
tracked by dpkg. BAD IDEA!

b) the used crypto key is stored in the / and the way how it is handled
is not transparent.

c) the script does not even have -e or -x option set, therefore if the
key file is renamed, it apparently dies somewhere and the user is NEVER
TOLD about the problem.

And the actual problem is that you are hardcoding some assumptions here.
For details, check the following file and ALL comments inside:

cryptsetup-initramfs: /etc/cryptsetup-initramfs/conf-hook

Basically you should store the file in /etc/keys, enable the pattern
option conf-hook config, and also NOT set the keyscript flag anymore
(because obsolete).

Thanks for your understading,
Merry Xmas.