It looks like GELI goes below zfs just like dm-crypt. That doesn&#x27;t allow you to scrub a locked dataset (one where the key is not in memory, possibly unknown). You could use zvols, of course, but that loses some (but not all) of the full-stack zfs benefits.