fresh install, encrypt as much as possible

[scar <scar%drigon.com@localhost>]

I want to do a fresh installation, and encrypt as much as possible.
Suppose I will have just one filesystem with everything on it.  It seems
with cgd it is only possible to encrypt certain directories of the root
filesystem, after NetBSD is already installed, and then restore these
directories from backup into the newly-created cgd filesystems.  Is
there a quicker way to do this, like during installation?

According the guide for cgd, i need to "leave at least the small root
(/) filesystem unencrypted, in order to load the kernel and run init,
cgdconfig and the rc.d scripts that configure your cgd."  What is the
"small root filesystem" that i need to leave unencrypted?

Thanks