WTF... For some reason I was certain that encrypted swap on Linux needs some complicated setup...

In reality, you just need cryptsetup, a line in /etc/crypttab that has the "swap" attribute and uses /dev/urandom as source for an ephemeral key (swap doesn't usually need to survive reboots), and then point your swap entry in fstab to the resulting device mapper device.

See cryptsetup FAQ, 2.3 How do I set up encrypted swap, https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions#2-setup or the CRYPTTAB(5) man page.