fish: '-i' option automatically handles whole-disk encryption.