Protecting the pwenc_secret File

[travis5462]

So I'm working on trying to encrypt/protect the /data/pwenc_encrypt file as this is used to encrypted all the AD/cloud credentials and rclone encryption password/salt. While I have password protected the pools, they are backed up to the cloud with rclone and encryption using the cloud tasks. So, if the system is powered off, all the data would still be accessible as you can decrypt the secrets from the local database file and access the encrypted cloud storage.

So my question is, is there anyway to encrypt/protect the pwenc_secret file so when the host boots, it asks for a password or uses a KMS to decrypt?

I know that physical security would be the better option all around but I'm just looking for any options that might be available.