Encrypting the parent and making sure it’s unlocked when LXD starts should be sufficient.
As far as I know, the only way you can turn things from unencrypted to encrypted is through send/receive. Either manually doing it one by one or you could create a new ZFS pool in LXD, make that one encrypted and then use lxc move to move containers over one by one.