> - Generate the encryption key for me, set up the systemd service to decrypt the pool at start up, and prompt me to back up the key somewhere

This should have an option to integrate use of a TPM for super-encrypting the ZFS encryption key(s).