I hope you understand that you still have a basic chicken and egg problem:
Whichever solution you choose for encryption, you must also solve the startup problem - how do you supply the key at startup? Do you assume that someone is always available to unlock the encryption?
Imagine that you are on a business trip, but the power failed and you want to establish a VPN connection. If your system is able to startup on its own, it means that the key is accessible somewhere, obviating your encryption scheme.
If you have a way to supply the key remotely, you would need a backdoor to your network, since the UTM is down, waiting for someone to supply the key.
You could assume that the UTM and local power are sufficiently reliable that the need to unlock when nobody is there is a small risk.
( or ... if you are away and your UTM is down, call the NSA and ask them to enter the key for you. [:P] )
