Ext4 encryption

> Each individual file is encrypted with its own key, which is derived from the master key and a per-file random nonce value (which is stored in an extended attribute attached to the file's inode).

I wish there was a little more discussion on this topic. It seems like an interesting choice that must be made for some specific reason. Yet, neither the article nor any of the links discuss this design choice. Is it to minimize seeking (to pull the directory master key), memory use (caching directory master key), or attempting to keep the total amount of data encrypted by a single key small?

Perhaps I'm not familiar enough with other disk encryption, but I'm not aware of other products that use a similar technique.

A longer discussion on key management would have been nice as well. There is mention of dealing with multiple users, so I wonder if keys will be managed more in line with LUKS, although the phrase "master key" is used quite often. In LUKS, there are up to 8 key slots that can be used to unlock the actual master key. Will there be a similar implementation where ext4 can store multiple key slots, and only the kernel gets access to the actual key?

Of course that leads to more complexity. Assuming that there can be multiple passphrases to access a single master key (which of course links to multiple directory master keys and multiple file keys), is it also possible to have multiple master master master keys (the kernel keyring logon keys)? It seems necessary for any sort of complex policy. Here's an example of what I mean.

3 Users -- Alice, Bob, and Eve -- are sharing a computer. Each one needs *one* and only one unique password (because password sharing is wrong) that they use to both sign into the computer and access their encrypted data. Each has their home directory encrypted, but only Alice and Bob have access to the encrypted data in /var/lib/mysql.

Do the keys and passphrases work out like this?

Eve: passphrase --> kernel logon key (serial number 0) --> /home/eve directory key --> ...
Alice: passphrase --> kernel logon key (serial number 1) --> /home/alice directory key --> ...
Alice: passphrase (same as above) --> kernel logon key (serial number 2) --> /var/lib/mysql directory key --> ...
Bob: passphrase --> kernel logon key (serial number 2) --> /home/bobdirectory key --> ...
Bob: passphrase (same as above) --> kernel logon key (serial number 1) --> /var/lib/mysql directory key --> ...

Basically, is there a mechanism for Bob and Alice to access the logon key #1 without sharing a password? I worry that if that's left to user space, a secure place to store the LUKS-style keyslot management data is lacking.