http://zqktlwk5ilgohy63eyrptyb4mc76bunfmxcnstkmveyjnskxkpq3b5yd.onion/wiki/Intrusive_Surveillance
I prefer to use GPG to encrypt the filesystem key, and have the passphrase I type into the keyboard be the password to the GPG key. This enables you to change the password without having to rebuild the filesystem. It also enables you to carry the key with you on a USB microdrive to ensure its safety and also to prevent anyone from mounting the fs even if they know the password.