Native ZFS encryption (OpenZFS): create, inherit, change-key
encryption=on at create. Children inherit. On Linux, rotate with zfs change-key.
Encryption
zfs send/recv from an unencrypted dataset into an encrypted one
No -w. -o encryption=on only on the first recv. The destination dataset name is required.