[phyrrus9]

FileVault can be set up all the way to the extent of every file having its own key.

Now this Is music to my ears (so to speak).

Despite the somewhat Inconvenience of accessing each file with a dedicated/segregated key, the security Is well and truly worth It.

filevault handles it automatically, it happens without the user even noticing. the NVMe drives are fast enough to handle the data overhead. most users that configure it that way use the same passphrase for every file though, but you don't have to (you'd just be prompted for a password if it isn't in the keyring)