ZFS encryption using T7-1 TPM

I have a freshly-built Solaris 11.3 on a T7-1.  I followed "Securing Systems and Attached Devices in Oracle Solaris 11.3" in order to activate the TPM and create a key in it.

I want to use that key to encrypt ideally all zfs datasets, but I've read Solaris 11.3 won't work if I try to encrypt rpool nor /var (Doc ID 2020729.1), so I'd like to encrypt everything else.

What I see is if I use a softtoken for the keystore I'd have to enter a passphrase after every boot.

Seems a TPM-generated key wouldn't require that.

I've tried following Darren Moffat's "How to Manage ZFS Data Encryption" but he doesn't show use of the TPM.