XTS is better than nothing, but to make it secure against key reuse from repeated snapshots we need to have IV / nonce per block, updated with every write - whi

XTS is better than nothing, but to make it secure against key reuse from repeated snapshots we need to have IV / nonce per block, updated with every write - which means we either need to keep them in the same block (thus, no power-of-2 block size for the hosted file system), or in some other way that doesn't kill performance (likely requiring co-operation from the hosted file system). The latter solution works in ZFS already.