Cryptoswap+cryptoroot+cryptohome as an installation option.

Allow the user to choose to start with an encrypted root, home, and swap partitions.

Boot can be unencrypted, as long as home and root are secure.

LUKS would be a preferred solution ... but anything secure would be acceptable. Access to home should be possible from a rescue cd provided you remember your passphrase.

Implementation needs to survive future upgrades.