Grab a snapshotDrop a head copy of check-password.4th into /boot and then apply the patch (only the patch to /boot/check-password.4th is required; no other changes are required but you do have to have a HEAD copy of check-password.4th to apply the patch).
NB: The rest of your /boot files can be up to 2 years old but no older.
Install automated ZFS with GELI enabled.
Bonus: for added bonus, use more than one vdev.
Reboot.
The boot loader should display "GELI Passphrase:"
prompting you to enter your geli(8) passphrase to
later mount the root device(s)NB: The test won't work unless your kernel has the following change
https://svnweb.freebsd.org/base?view=revision&revision=273489
Then put into /boot/loader.conf:
geom_eli_passphrase_prompt="YES"
and reboot.