I use fscrypt, my typical threat case won't be able to break it, and I think the failure mode is more graceful (you can set up alternate methods for decryption,

I use fscrypt, my typical threat case won't be able to break it, and I think the failure mode is more graceful (you can set up alternate methods for decryption, I use a backup password). FDE should be possible with the right kernel support, but not sure this exists today.