gocryptfs is available in toltec[0]. So you could in theory add full device encryption behind a password on startup. I know there has been some work on creating a UI for this kind of setup, but I don't know if anyone has actually released one yet.
There is also https://github.com/plan5/remarvin