Allow bootfs on an encrypted filesystem. Requires a newer grub (specifically
zfs-grub) which supports booting on a encrypted root FS.