#Synology DSM version 7.2 launched "volume encryption" that's supposed to prevent you from being pwned if your disks are stolen. In the default configuration, your data is safe as long as one disk is stolen, or even a subset of disks, but if the entire NAS is stolen, so is your data.
7.2 allows you to escrow the keys on a different Synology NAS, physically located where ever. But if *that* NAS is stolen and your original NAS is stolen, your data is once again stolen.
This is broken and laughable encryption, by-design. The obvious solution -- just asking the user to enter a key or upload one on boot -- is absent. This is not hard to implement and would be the safest option, but here we are: nothing.
https://kb.synology.com/en-global/WP/Synology_Volume_Encryption_White_Paper/1
Nearly 6 months after this was released, still no updates or anything to resolve the situation.