I understand a complete server reset would be inconvenient.

I’m quite fond of veracrypt: It offers good encryption and is transparent when mounted.

You can create and mount a container file with veracrypt, copy your existing data in there and replace the original folders with appropriate symlinks. I think thats the best tradeoff for good protection and convenience

Depends ok the DRM technology. The only PDF DRM I came across so far was using the horrible feature by adobe digital editions.

It can be removed by using calibre and an unofficial plugin called noDRM, which should work on Mac as well (didnt test it tho, I dont own a Mac. Worked fine on windows tho)

I’ve been contributing to it via Street complete (can get it on fdroid) and it has become quite a hobby of mine.