As for full disk encryption, you can select where to store the key, which may be on the NAS itself (rendering FDE more or less useless) or on a USB key or similar.
As a KMIP server you use:
- Another Synology NAS with DSM >= 7.2
- A KMIP compatible key server
--
0: https://kb.synology.com/en-global/DSM/tutorial/Which_models_support_encrypted_volumesThe DSM itself lives in an unencrypted partition or volume. Applications with data in encrypted volumes will be inaccessible until the volumes are unlocked.
As usual, there is an easy workaround. You can run a KMIP server in a docker container and set up an external keystore. Once synology allows you to proceed with volume encryption, you can discard the KMIP server if you want and use the recovery keys.