Comment by BSDobelix

> set Encrypt Disks to YES - nothing else required.

Plus "Encrypt Swap" should ~always be used even on non Root-GELI-Systems ;)