@syntax I would use VeraCrypt, you can benchmark it on the PI but any low-grade encryption should be good enough without noticing any large speed degradation. AES-256 is lightning fast, and while not the most secure it's enough for another layer. Cryptomator could also work if you don't have much experience with VeraCrypt.