Shouldn't the filesystem be set to encrypt everything before it hits the physical storage layer?