How do I use Step 6 of Proxmox instructions for ZFS with encryption?

[pl804]

How do I use Step 6 of the Proxmox setup, but for ZFS with encryption, instead of gocryptfs?

I'm a complete beginner.

Here's what I tried so far:

Using ChatGPT, I started with the following, logged in as root:

apt update
apt install software-properties-common
apt-add-repository contrib
apt update
apt install zfsutils-linux
mortar-compilesigninstall
modprobe zfs
mortar-compilesigninstall

I got stuck on the 2nd to last step (modprobe zfs) which was supposed to load the ZFS module into the kernel, but instead returned an error:

could not insert 'zfs': Key was rejected by service

So maybe ChatGPT is hallucinating? It suggests disabling Secure Boot, or signing the ZFS kernel module, but I'm not sure either one makes sense. Sorry, I know we're kinda far afield from the instructions, but any idea whether I'm going in the right direction?

For now, I reverted the .efi file generated by the 3rd to last step. On a sidenote, when I ran mortar-compilesigninstall in the 3rd to last step, I got a warning:

data remaining[51864064 vs 518767705]: gaps between PE/COFF sections?
data remaining[51864064 vs 518767712]: gaps between PE/COFF sections?

ChatGPT's next steps afterward were:

lsblk

Then I was going to use Step 6 from your Proxmox instructions to generate a key but to /etc/zfs/private, set secure permissions, then create & verify a mirrored ZFS pool for my 2 NVME disks:

zpool create -o ashift=12 \
                  -O encryption=aes-256-gcm \
                  -O keyformat=passphrase \
                  -O keylocation=file:///etc/zfs/zfs.key \
                  -O mountpoint=none \
                  -O compression=lz4 \
                  -O dedup=on \
                  mypool mirror /dev/nvme0n1 /dev/nvme1n1
zpool status mypool

ChatGPT says because it is ZFS, I can skip partitioning and don't need to use fstab.

I wasn't sure if I needed to specify a specific mount point, but if so, would do:

zfs create -o mountpoint=/mnt/data mypool/data

And enable automatic mounting with:

systemctl status zfs-mount.service
systemctl enable zfs-mount.service

And manually confirm mounting with:

zfs mount mypool/data
zfs unmount mypool/data