dm-integrity is a ZFS-like feature that can be used together with
buildkernel + LUKS + LVM + ext4
I think dm-integrity should be enabled in buildkernel by default and added to
Sakaki's EFI Install Guide
See also https://security.stackexchange.com/questions/190670/luks2-dm-integrity