I think the main issue is that decrypting in GRUB takes significantly longer (factor 4, or so) than decrypting in the kernel. Maybe that issue should be addressed first.