I’d go with the Full Disk Encryption. You can be sure everything is encrypted that way. Any additional complexity adds ways to mess up and compromise security. Entering the password is a bit cumbersome. But that’s part of the deal. I just carry my computer keyboard to my NAS and enter the password each time I need to reboot. Which doesn’t happen that often. There also used to be some tutorial somewhere on how to put a Dropbear SSH server into the initrd so you can enter the password over network.
There are no tags as of now. Everyone is running the main branch from Git. I suppose that’s going to change at some point when PieFed deems itself ready.