Device-mapper is yummy.

cryptsetup create secflash /dev/sda1
Enter passphrase:

There. I now have /dev/mapper/secflash that I can mkfs, mount, and whatnot. And everything is crypted.

Pity the docs don't tell me that so easily. I spent ~3h over the last few days to find out that all I needed is the above.

Well, that and my fight with make-kpkg. But that's for another time.