Thus said Janne Johansson on Wed, 12 Aug 2026 14:39:59 +0200: > That is correct, and if ever mfs contents get swapped out, the swap on > openbsd is always encrypted by a per-boot random key, so noone could > dig it out of the swapdevice on the next boot even if you don't use > FDE.
Are you sure? It seems the default is: #vm.swapencrypt.enable=0 # 0=Do not encrypt pages that go to swap Andy
