...root filesystem ext4 is on luks encrypted partition, clevis/tang is configured so the root file system get auto decrypted when boot.
disk2-ssd zfs, disk3-sdd zfs, disk4-nvme zfs are full disk encrypted with luks, zfs on top of those luks encrypted disks, all striped, so single disk per pool...