@hyc I believe you're correct.

@hyc @oxyhyxo The authorized_keys file for a user is stored in that user’s home directory by default, and the home directory isn’t decrypted and mounted until after the user successfully authenticates. I can see a few ways it could be made to work, but all would take non-trivial changes to how key-based SSH authentication currently works (e.g, moving user keys to /etc/ssh/userKeys/<username>/authorized_keys, and using agent forwarding to get the user’s private key to decrypt an escrowed ZFS key).