I have seen the following thread and mine is similar set-up (not exactly the same).
I understood that the kernel images need to be outside for this and can not update the kernel images as part of the rootfs update.
My worry is how the mender OTA update on rootfs works without specifying the physical block. If mender accesses the physical block (/dev/mmcblk0p1) and delete the partition, then the system will not mount it because encryption voids in this case. The physical partition is hidden always with dm-cyrpt and we can use the virtual physical partitions (/dev/dm-1 instead of /dev/mmcblk0p1) for the update.
However, specifying this /dev/dm-1 not passing the build.
It looks like the mender 2.0 's “meta-mender-core/classes/mender-helpers.bbclass” only define “/dev/mmcblk*p*” or “/dev/mmcblk*” for the U-boot.