added prominent note to use LUKS (not plain dm-crypt) unless