The install config allows users to specify a `diskEncryptionSet` in machinepools. 

CAPZ has existing support for disk encryption sets:

https://github.com/kubernetes-sigs/cluster-api-provider-azure/blob/38a5395e4320e116882734ffd420bf4a1f959ff2/api/v1beta1/types.go#L670

Note that CAPZ says the encryption set must belong to the same subscription, whereas our docs may not indicate that. We should point this out to the docs team.