It's a very buried feature, but the deck actually supports home directory encryption as well, though you have to SSH in from another machine to set it up. I really think it should be made default because of the very real use case where users use desktop mode, sign in to things in the browser and then take the device out in public where it could be stolen.