Down another rabbit hole I go. This time, on ZFS on-disk encryption. I was surprised this is not enabled by default, but I'm a noob, so bare with me.
You can run the follow to set encryption to on:
zfs create \
-o encryption=on \
-o keyformat=passphrase \
-o keylocation=prompt \...