you're right! except... it supports a half-ass encryption feature, which is subject to [some pretty easy attacks](https://www.qemu.org/docs/master/system/images.html#cmdoption-qcow2-arg-encrypt.format ). usage is explicitly discouraged in the project and has been for a good while now. I believe but cannot prove that the qcow encryption stuff predates common availability of LUKS and similar full-disk encryption suites in guest OSes.
CC: h3artbl33d :openbsd: :antifa: (npub1y90…900y) Parade du Grotesque 💀 (npub19ye…npv6)
