Oh right — I could do a local HFS+ non-encrypted disk with encrypted Time Machine (I assume) — that just slipped my mind.