TCFS is a pretty nifty little package.  It uses currently unused
bits in the inode to flag if a file is encrypted or not, so you
can mix encrypted and plaintext files on an unmodified FFS partition.
And the patches for NetBSD-1.6.1 work on NetBSD-1.6.2.  It actually
only requires patching three kernel files and installing some new
files to support the new functionality.  Anyway, it's available on
my web site:

http://vaxn8.tripod.com/tcfs/NetBSD162/index.html

So stop starting and start!  You know you want it.  It's as easy as:

1) # cd /
2) # patch < /path/to/tcfs_normal.patch
3) # tar -xvf /path/to/tcfs_extra.tar.gz
4) Recompile your kernel and the new utils.

I'm working on making official patches, but it may not happen due to IP
concerns since I can't seem to reach the people who wrote it.  Hmm.