When using zfs, could you consider creating a separate boot pool (like seen here: https://openzfs.github.io/openzfs-docs/Getting%20Started/Debian/Debian%20Buster%20Root%20on%20ZFS.html) so that some features might be enabled on the root pool, such as encryption?