Comment 20 for bug 1773457

If you want to preserve other OS and setup encrypted partitions by hand, you can do so, since forever using the mini.iso d-i installer, and install ubuntu-desktop task.

yes unencrypted /boot is currently a limitation with grub, but you can use sicherboot package to boot UEFI based systems securely without /boot, as that ensure the bootloader, kernel, initramfs are all in the UEFI partition, signed and booted with secureboot.

none of that is typical for a desktop installer, nor is easy to explain in the UI. And things like above is adequatly easy to setup using the mini.iso and additional packages. For a mass-install corporate environment, I would expect internal sysadmins to either prepare d-i preseeds or custom golden images to deploy machines with such a sophisticated setup.