I am new to BSD. What I'd like to do is mirroring two SSDs and encrypting everything that is possible. I mean the entire OS and even the swap partition (I guess BSD has one too). As far as I understand as long as the motherboard does not support booting with encrypted disks I have to keep the boot loader unencrypted. With secure boot I can check if nobody tampered with the boot loader, so that part is fine. I am not sure what boot loaders you use and what they support. As far as I know GRUB supports only ZFS + LUKS, but not ZFS native encryption. I would rather stick with ZFS native, because with LUKS both disks are encrypted differently, which means double CPU usage. Another reason that I suspect that ZFS mirrors and checksums the encrypted content, which I think is better than mirroring and checksumming the unencrypted one, but maybe I am wrong. Now I read about GELI full disk encryption too, but I assume that isn't built into GRUB either. Do you have a better boot loader I could use or maybe a better solution?