Linux

I use an encrypted rootfs without "an initramfs". Just requires some advanced fuckery.

A little known fun fact is that almost all kernels have a tiny stub-initram built into the kernel file. This is added when initram support is enabled, and is loaded before dedicated files are. It is however possible to supply your own initram directory or archive during kernel build to replace this built-in initram, so you can bake it in without leaving a separate file. No juggling with partitions, no boot options. Works just like a normal kernel "without initram", since even kernels without one usually do have that stub one anyway.

The downside is that a) you have to build the kernel, and b) the files to pack have to be available when the kernel is built, meaning you can't pack in modules of the kernel. But when building your own kernel anyway you can simply set the needed modules for encryption built-in and only pack the userspace cryptsetup executable needed for decryption, that way you get it all in a single kernel build, and the output is a single uniform kernel binary capable of decrypting your boot drive. No flags, no extra files, no access to the esp needed.

(I use gentoo with encrypted root btw.)