My understanding is that during the boot process using ZBM's initramfs: 1. ZBM prompt for encryption passphrase, decrypts the filesystem, locate kernel/initram

My understanding is that during the boot process using ZBM's initramfs: 1. ZBM prompt for encryption passphrase, decrypts the filesystem, locate kernel/initramfs on ZFS datasets, then display boot menu 2. ZBM kexec into the kernel on the filesystem using the chosen kernel/initramfs while appending root=zfs:... to the kernel parameter 3. The target kernel decrypts the filesystem[^] and mounts the root ZFS again and boot into final system [^]: In this case, ZBM requires the encryption key to be placed in the target initramfs (not ZBM's) for the target kernel to load (dataset need to be decrypted again since kernel state is disregarded). This initramfs is located inside the encrypted filesystem itself, only accessible after initial decryption/mount by ZBM in step 1, so the only way to obtain this key is to already have access to encrypted filesystem in the first place.