For my NetBSD install I wanted to include _disk encryption_ to protect personal data in case the device is lost or stolen.
Its not really enough to simply encrypt home directories. Passphrases and sensitive data can linger and be extracted from locations such as system logs and swap memory. There is a trade-off to be made between how much to encrypt, the convenience of operating the system, and the ability for the system to boot.
This is how I do it...