Eventually settled on org-mode. Encryption can be sync-time using restic/cryptomator (cloud sync), filesystem (self-hosted all the way), or save time using plain old GPG. As a bonus, there is a gigantic ecosystem around org-mode, and thanks to the platform (Emacs) it is nearly completely FLOSS and pretty much guaranteed to be around and kickin' when most commercial systems with either die, get acquired or just change too much for my taste.

Probably not for everyone, though.

Obsidian has that. And is more extendable. That is why I switched.

For me, writing a note on multiple devices is the key feature.