Yeah I just implemented a new stack and noticed OpenTofu now supports client side encryption for the state files in with keys stored in Azure KeyVault (in the latest 1.11 release). AWS and GCP had been supported for a while.

Client side state encryption was one of the things which HashiCorp always gatekeeped for HashiCorp Cloud and never implemented in the Open Souce / Sourece Available versions.