Native ZFS encryption (OpenZFS): create, inherit, change-keyencryption=on at create. Children inherit. On Linux, rotate with zfs change-key.