I understand a complete server reset would be inconvenient.

I'm quite fond of veracrypt: It offers good encryption and is transparent when mounted.

You can create and mount a container file with veracrypt, copy your existing data in there and replace the original folders with appropriate symlinks. I think thats the best tradeoff for good protection and convenience

Depends ok the DRM technology. The only PDF DRM I came across so far was using the horrible feature by adobe digital editions.

It can be removed by using calibre and an unofficial plugin called noDRM, which should work on Mac as well (didnt test it tho, I dont own a Mac. Worked fine on windows tho)

Dream Theater and Classical music have entered the chat

Was actually confronted with the same problem - thank you for the solution!

Aegis authenticator. Beats all proprietary apps I've tried so far