[Android Q&A, Help & Troubleshooting] szty0pa:
Seems like we have compelmenting experiences in this regard: I don't know much about android (as in the middleware above the linux kernel), but have some experience with linux itself (embedded platforms included).

Reading thought the linked articles I got the impression that the 'encryption' in android is quite a complete ecosystem including the software, the bootloader, even the hardware to provide a full chain-of-trust. It is surely not implemented in the Y550 this way, and we cannot do anything about it.

(To help with the jargon: fuse bits are special registers in the memory which contain the value of say '1' initially and stay like that if the required conditions are met - say the chain-of-trust is unbroken - but can be changed to 0 - which is a one-off single way change per every boot! if the chain is broken. So this way one can tell if the system can be trusted or not. Uboot: is the universal bootloader for embedded systems: it's like the BIOS on your x86 PC for arm/mips/etc. platforms. Signed image: the firmware image or the individual (binary) files are hashed, and this hash value is/are included with the image. This is the way to tell if the files have been changed because then the hash will change aswell. (These hash values are the links in the chain-of-trust.) If you download something from the internet which has an md5 or sha (these are the most common hashes used online) sum next to it you can check if your downloaded file got corrupted while or before downloading if you compare the hash of your file with the hash you found online. (This is how torrent for example works as well.))

Back to the original topic: I wasn't thinking of implementing the whole chain-of-trust as this is impossible without modifying the bootloader (and possibly the hardware as well), but simply to encrypt the contents of the memory partition where the /home folder (/sdcard in android) is stored on. That is fairly easy in the linux-world, but android is not very well prepared for that. (To be honest android doesn't even use filesystem permissions sanely.)

This was solved however on my tablet (flo) somehow without any radical changes to the bootloader. When it starts to boot it asks for the password to unlock the filesystem, and continues on booting when it gets the correct password. I am fairly sure it doesn't have a valid chain-of-trust (I'm using a patched custom operating system on it), only the filesystem is encrypted a' la the simple linux way. (The only difference is the onscreen touch keyboard to be able to enter the password.) Don't know how difficult is it to rip it out of android to use it on its own - much like in twrp.

For microg: if you just want to use google's ecosystem (like the minimal microg config) it's enough to add the microg repo to fdroid and install the core packages. And as I just recently found out the other half of this project is nanolx (nanolx.org) - if you add that repo to fdroid as well, install their patched playstore and download, install the nanolx-patcher from twrp you will have an almost perfect google core substitute (maps, push notifications - that's the gcm - working fine). Battery use is a bit better for me: I don't have to constantly kill the apps that use a background connection since gcm will take care of that; but it's slightly worse for my parents who otherwise wouldn't use the phone much.

(To give you some numbers: for me with very moderate use on the titan (which is very much like the y550 with an older cpu, more storage and a better build quality) goes on for about 3 days - which is roughly the same as without microg/nanolx but I don't have to kill the apps every time and have almost realtime notifications when something happens (message or email arrives). For my parents (y550) with almost no use at all the uptime went down from about 5 days to about 3 days.)