Inline encryption support for block devices

A global user-managed keyring would be nice, block-level encryption for selected files is a nice feature in general even without ICEs.