Quick note on #2 - there aren't really any issues with storing your encryption root passphrase in a file. If the file is owned by root, with no read permissions for any account, only root can access it. Since it's stored on an encrypted dataset, and your initramfs is as well, it's unreadable when the machine is off. Lastly, if anybody _does_ have a root shell on your machine, they can change the encryption passphrase without needing to know the current value.
In short, I'm not sure there are any real issues with having it on disk but unreadable by anybody but root.
In short, I'm not sure there are any real issues with having it on disk but unreadable by anybody but root.