As an added bonus, with (Open)ZFS encryption, you can send the 'raw' encrypted zfs send stream (over an encrypted SSH connection) to a destination where the file system is encrypted and where the zfs receive command does not have to decrypt it to save things.

That is, the remote destination does not need to have the key/passphrase to the file system to have an (encrypted) copy of the data.

If your production server goes down, you can restore the encrypted file system without the encryption key, and only when you try to mount the restored ZFS file system will you be prompted for the key/passphrase.

> This means that you can use ZFS replication to back up your data to an untrusted location, without concerns about your private data being read. With raw send, your data is replicated without ever being decrypted—and without the backup target ever being able to decrypt it at all. This means you can replicate your offsite backups to a friend's house or at a commercial service like rsync.net or zfs.rent without compromising your privacy, even if the service (or friend) is itself compromised.

* https://arstechnica.com/gadgets/2021/06/a-quick-start-guide-...