@two_handed
Sorry I moved to CopperheadOs, my Mi5 was only pure lineage with F-Droid as system app.
I noticed that you don't have access to /data on you encrypted lineageOs phone which means apps data, pictures, music, etc... But you still have access to everything else (/system included) through adb/fastboot.
I wanted a secure phone without google crap, only FLOSS apps, and CopperheadOs is one of the few allowing you (more like forcing you) to relock you bootloader to activate boot secure and prevents anyone to use fastboot/adb shell if your phone gets stollen.
Concerning your question, maybe this
http://sovworks.com/eds/ ? Sort of veracrypt for android, also working with veracrypt containers.