@cdrmack It's #GELI for me. If your threat scenario is physical hardware access by unauthorized persons (like e.g. a stolen laptop), you want to leak as little information as possible. With GELI, all you need is some #ESP (#EFI partition) with #FreeBSD's loader(8) installed, it supports booting from GELI.
If, on the other hand, your threat scenario is unauthorized access to some data by someone who *is* authorized to access the machine in general, just not that specific data, per-dataset encryption as offered by #ZFS is the better match. A concrete scenario could be a machine used by multiple users that don't necessarily trust each other. That way, some datasets can remain "locked" while the machine is up and running, but of course you'll always expose pool metadata (like, which datasets, snapshots etc exist at all).
You might combine both approaches if you *really* need to. 😆
