Enryption - how is the key file protected against physical access of the TN host?

[flashdrive]

Where is the keyfile stored? On the boot pool?

The boot pool itself is not encrypted, correct?

If physical access is gained to host itself - how is a protection of the keyfile possbile?

In my scenario a switch to passphrase is not feaseable from a comfort point of view (yes, encryption is seldom comfortable).

 

[flashdrive]

see also https://www.truenas.com/community/t...fety-option-physical-access-prevention.92210/