@JourneymanGeek seems I was wrong about ZFS encryption - it does indeed decrypt for all users with access, which means root always have access to encrypted data when the key (passphrase) is loaded.
You need to use FUSE if you want to encrypt for the current user only, which should be taken into consideration.
