Synology NAS (DS218+) and Full Disk Encryption (FileVault2)

To answer your first question about the keychain and whether you should encrypt backups: the passwords in your keychain are already encrypted, that's why you always have to type a password (by default your login password) to show stored passwords. So there's no immediate need to encrypt.

Of course, you could add Time Machine encryption to provide a further layer of security. This is possible starting with OS X Lion and Mountain Lion (from http://support.apple.com/kb/ht1427):

OS X Lion and Mountain Lion let you encrypt the Time Machine backup external drive using FileVault 2.

FileVault2 also uses your login password, though. So if the bad guys are able to guess or crack that password, they will have also access to your keychain information. Choosing different passwords for login and for accessing your keychain would protect the keychain passwords in such an event.

Either way, use strong passwords, password quality is of foremost importance to protect your data.

EDIT:

The OP asked in a comment how to set different passwords for login and keychain. Here is how:

• Open Utilities>Keychain Access.

• Right click each keychain and select 'Change Password for Keychain XYZ':

  

If you prefer to use your current password as keychain password and change your login password, log in using another account and change your account's password from System Preferences>Users & Groups. That will only change your login password, not your keychain password.

I strongly advise to use full FileVault 2 encryption instead of using the FileVault 1 wannabe below!

You can mimic the FileVault 1 behavior either with an encrypted sparse bundle image or a second volume encrypted with FileVault 2. Two users are needed though and it's no elegant solution.

A proper backup of your OS X system volume before conducting one of the two how-tos below is strongly advised!

Example how-to with a sparse bundle image:

usera: admin user - usere: user with user folder which should be encrypted

• as usere create an encrypted sparse bundle image - large enough to hold all current and future usere content

• mount the image and create a folder with the name usere and modify it with chmod 744 ...

• log out as usere and log in as usera
• disable "Ignore Ownership on this volume" of the mounted sparse bundle image

• Open Terminal and enter

  su usere
  

• Now - as user usere - copy the content of the home folder of usere to /Volumes/name_of_sparsebundle_volume/usere:

  rsync -aAvX /Users/usere/ /Volumes/name_of_sparsebundle_volume/usere
  

• rename the old home folder of usere:

  mv /Users/usere /Users/userebackup
  

• exit usere - now you are usera again

• link /Volumes/name_of_sparsebundle_volume/usere to /Users:

  sudo ln -s /Volumes/name_of_sparsebundle_volume/usere /Users/usere
  

  You may have to modify the permissions of the soft link with sudo chown usere:staff /Users/usere and sudo chmod 744 /Users/usere.

• Now log out as usera and log in as usere
• Check if everything works

• If everything is fine, remove the folder /Users/userebackup:

  rm -Rd /Users/userebackup
  

Example how-to with FileVault 2:

The method is the same except that you have to encrypt an empty volume (right-click volume -> encrypt volume) instead of creating a sparse bundle image.

You can't log-in to usere directly because neither the encrypted sparse bundle image nor the FileVault 2 volume are mounted while the system boots. You either have to log-in as usera, mount the image/volume, log-out as usera & log-in as usere or you may log-in in console mode, mount and unlock the image/volume and log-in as usere. The latter is untested because I didn't get it to work in my VM.

According to Internet sources encrypted sparse bundle images are prone to (encryption) header corruption. Such a header corruption may render the image un-unlockable!