[phyrrus9]

Now this Is music to my ears (so to speak).

Despite the somewhat Inconvenience of accessing each file with a dedicated/segregated key, the security Is well and truly worth It.

filevault handles it automatically, it happens without the user even noticing. the NVMe drives are fast enough to handle the data overhead. most users that configure it that way use the same passphrase for every file though, but you don't have to (you'd just be prompted for a password if it isn't in the keyring)

How do you do that? I don't see many options in System Preferences, and fdesetup doesn't seem to have a way to do that...

Have a look at this article

Apparently in newer versions you've lost the ability to use FV to encrypt any old file, but you can still encrypt sparse files, emulating the ability to encrypt folders.