I just thought I'd document the sort of things here I would have
expected to find in the official NetBSD disk encryption guide:
https://www.netbsd.org/docs/guide/en/chap-cgd.html
[...]
Perhaps this will inspire somebody who knows how to fill in the gaps:
It was brought to my attention NetBSD 11 likely doesn't support the
system partition / being encrypted and using ZFS, at all.
Then I think the logical next best setup is, for both the guide and
perhaps a hypothetical future "install it for me please" option:
1. A GPT partition layout, and
2. /etc/cgd boot partition unencrypted, and
3. optionally an EFI partition for modern GPT UEFI boot setup, and
4. / system disk encrypted using UFS2, and
5. /home encrypted using ZFS (or in the future perhaps GeFS), and
[...]