You could do it by hand with bioctl since forever. You had to spawn a shell with ! from the installer, run the bioctl commands to assign a new device to get encrypted and then on installing you would select that new device instead of your raw disk.