OpenBSD 7.4 added support for guided full-disk encryption.

Support for softraid(4) disks in the installer was improved:

• Make root on softraid(4) installations boot out of the box on Raspberry Pis (arm64).
• Add arm64 to the list of architectures with support for guided disk encryption.

I just tested it, and it's amazing!

The installation process is nearly identical to that of x86_64 systems. You write the installer to a flash stick and boot the Pi from it. The installer will later ask which disk to install to, and offer disk encryption.

You need access to the serial console via UART. The arm64 installation notes explain it in more detail.

Recently I had to return to the Linux land, and I managed to install Alpine Linux on an encrypted root disk. It's a lot easier than messing with Raspberry Pi OS.

But the existing documentation wasn't enough, and the Raspberry Pi has more than a few particularities when it comes to the boot process. To document all these non-obvious things, I've created a new wiki page: Raspberry Pi - LVM on LUKS.