grub-mkconfig is implemented incorrectly causing detection of cryptodisks to fail.
I have attached a patch that makes it work correctly, but you probably want to
tidy it up some further. For example, GRUB_CRYPTODISK_ENABLE is only effective
if its value is "y", which is inconsistent with the other settings.
This patch makes running `update-grub`, able to generate a grub.cfg for an
encrypted /boot volume. This /boot volume will not boot by itself, but will
boot if you copy the grub.cfg to an unencrypted /boot which you might carry
around on a USB stick on your person. I have verified this personally and am
now using a fully encrypted system volume with separated unencrypted boot
device that is physically secure.
Related bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542165
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463107