GRUB Standalone with embedded config file and different keymap

It is possible to create a single GRUB EFI binary without any additional config files, modules, drivers, themes etc. on the boot partition. All those files will be put in a tar memdisk and then included into the binary itself, creating a "standalone" .efi file.
While that isn't really necessary for most users, it can be beneficial for full disk encryption scenarios.

GRUB is the only boot loader that can decrypt a LUKS blockdevice as of today.
However, in the standard configuration GRUB places its config files and drivers onto the boot partition. But on a fully encrypted disk, those files can't be read at boot.
Consequently no customization (e.g. changed colors, background, screen resolution) is available and one is greeted by an ugly password prompt before one can even chose what kernel or OS to boot.
Also, the decryption takes ages, even on a modern CPU. If you just want to boot a different OS on a dual boot machine this can be very tedious.

One solution could be to place all those extra files onto the unencrypted EFI system partition.
This gives you instant access to the GRUB menu and only decrypts the boot partition when necessary (e.g. actually booting the kernel).
Still it leaves the drivers and grub.cfg open to tamper with. The solution is to combine everything needed into one big EFI binary (and sign it for secure boot).

• Generate grub.cfg

# grub-mkconfig -o /boot/grub/grub.cfg

Nothing special here. We just create the needed grub.cfg that will be included into the binary later.

• Generate keyboard layout (e.g. german)

We need to generate the keyboard layout we want to use later, otherwise GRUB uses the US layout. When entering passwords this could be potentially fatal. This may be skipped when using said US layout.

# grub-kbdcomp -o /boot/grub/de.gkb de

•  Create memdisk

$ tar cf memdisk.tar /boot/grub/

You may skip locales and themes you don't need to prevent one really large binary.

• Create early configuration

Create an early-grub.cfg with the following content:

root=(memdisk)
prefix=($root)/boot/grub/
keymap /boot/grub/de.gkb

This just tells GRUB to use the memdisk instead of any other location for its modules and to use the created keymap.

•  Create the efi itself

# grub-mkimage -c early-grub.cfg -O x86_64.efi \
-o /boot/efi/EFI/grub/grubx64.efi -m memdisk.tar \
-C xz memdisk tar keylayouts

This will create the standalone .efi file at /boot/efi/EFI/grub/.
Bear in mind that every time you make changes to the original grub.cfg (e.g. new kernel), you need to create a new rmemdisk and binary. This could be automated with a script of some sort.

Now the .efi file should be signed with your own Secure Boot keys.