On that USB stick of yours create a
/boot directory where you put all the needed stuff, including your
/boot/loader.conf. Copy the modules you need to load at boot time to
/boot/kernel. That would include kernel, zfs... anything else?
This will not enable the
boot from encrypted zfs pool (don't think it's possible at all), but, which is close enough, will mount it as your
root. It was already discussed elsewhere that encrypted root makes little sense from the practical standpoint. Still, if you wanna stick to it, use this USB solution.
Oh, and this way you aren't limited to legacy bios. Add EFI partition to that USB of yours and make it UEFI-bootable. So you'll end up with 2 partitions on your USB: EFI, freebsd-ufs. Not describing here how to install UEFI loader, most likely you know where to read about it
