> because it's a PITA to enable

I went over the blog post, and it looks like it's a PITA to enable because they went out of their way to make it so by using a weird partition scheme. I've never installed pop OS, but according to that blog they're using LVM on LUKS, which should work fairly well.

> but as far as I know no distro does this correctly by default on an encrypted drive.

What does "correctly" mean here? On my previous laptop I had arch installed on ext4 on LVM on LUKS. Therefore, the swap was on the same LVM. Aside from having to manually set the "resume" kernel parameter, I never had to do anything, and it just worked.

Because it's a pain in the ass for what should be the default, especially if you want to use it on a laptop and not have the battery die overnight.

Some argue full disk encryption should be the default. Others argue hibernation should be the default. Here they appear to be in conflict, and that the former was prioritized.

But they're not. You can very well have the swap on top of LVM on top of LUKS. And the root and other partitions share that same LVM and LUKS. So now you have FDE and the kernel will know how to assemble it all. The only difference with the default pop OS install is that the swap key isn't changed on every boot. But since the other partitions holding the actual data use persistent keys, that doesn't look like much of an issue to me.

Plus, if you're OK with using a TPM, you can also get waking up from hibernation without having to enter type in your password.

Source: been doing exactly that (without the TPM part) on a laptop for a few years, and it just worked like a charm. No hoop-jumping involved or anything.

If I wanted full disk encryption, my memory state in swap would sure as hell be one of the things I wanted encrypted.

Of course, you would. And it is. All the partitions, including swap, are on top of a LUKS volume.

ah, ok. Apologies.