Encryption

LUKS: back up and restore the header, and add, change or remove keys

No header, no data, passphrase or not: back it up off the disk and back it up again after every key change, because the old backup keeps the old keys.

Native ZFS encryption (OpenZFS): create, inherit, change-key

encryption=on at create. Children inherit. On Linux, rotate with zfs change-key.

zfs send/recv from an unencrypted dataset into an encrypted one

No -w. -o encryption=on only on the first recv. The destination dataset name is required.