> Also, once you've got per-user encryption on ~/.ssh/authorized_keys you'll need some other mechanism for users to log in.
OpenSSH supports this through the AuthorizedKeysFile directive - it'd be quite simple for the homedir mounting tool to sync that file from the user's authorized_keys file on unmount.
You could also use SSH certificates, but that requires a CA - not ideal for the home user.
And don't think of having the users do their own backups - locking users' home directories mean they won't be able to run their own cron jobs.