This took quite some time and the interweb was not that helpful, so here it is:

As this particular freebsd machine is running within a qemu backed kvm virtual machine we first need to resize the image

$ qemu-img resize freebsd.img +20g
Image resized.

I booted the freebsd guest with the install cd and startet a rescue shell. To access the rescue system via the serial port, start a getty on ttyu0

# /usr/libexec/getty std.115200 ttyu0

and login as root without a password

$ virsh console freebsd
Connected to domain freebsd
Escape character is
FreeBSD/amd64 (Amnesiac) (ttyu0)

login: root
Last login: Sat Sep 19 09:55:26 on ttyv3
<lots of output skipped>

root@:~ #

First i checked the gpt partition table

root@:~ # gpart show
=>      34  20971453  vtbd0  GPT  (30G) [CORRUPT]
        34      1024      1  freebsd-boot  (512K)
      1058   4194304      2  freebsd-zfs  (2.0G)
   4195362   4194304      3  freebsd-swap  (2.0G)
   8389666  12581821      4  freebsd-zfs  (6.0G)

Note that it tells you that the gpt is corrupt, this needs to be fixed with

root@:~ # gpart recover vtbd0
vtbd0 recovered
root@:~ # gpart show
=>      34  62914493  vtbd0  GPT  (30G)
        34      1024      1  freebsd-boot  (512K)
      1058   4194304      2  freebsd-zfs  (2.0G)
   4195362   4194304      3  freebsd-swap  (2.0G)
   8389666  12581821      4  freebsd-zfs  (6.0G)
  20971487  41943040         - free -  (20G)

As the encryption key is located on the bootpool we first need to import the zpool:

root@:~ # zpool import -fR /tmp bootpool
root@:~ #

next we open the geli device (gpt partition 4), this needs to be done before resizing the gpt partition

root@:~ # geli attach -k /tmp/bootpool/boot/encryption.key vtbd0p4
Enter passphrase:
root@:~ #

List the geli device and make sure to write down the consumer media size

root@:~ # geli list
Geom name: vtbd0p4.eli
State: ACTIVE
EncryptionAlgorithm: AES-XTS
KeyLength: 256
Crypto: software
Version: 7
UsedKey: 0
Flags: BOOT
KeysAllocated: 2
KeysTotal: 2
Providers:
1. Name: vtbd0p4.eli
   Mediasize: 6441889792 (6.0G)
   Sectorsize: 4096
   Mode: r0w0e0
Consumers:
1. Name: vtbd0p4
   Mediasize: 6441892352 (6.0G)
   Sectorsize: 512
   Stripesize: 0
   Stripeoffset: 541696
   Mode: r1w1e1

in our case 6441892352.

now resize the gpt partition

root@:~ # gpart resize -i 4 vtbd0
vtbd0p4 resized
root@:~ #

resizing the geli device right now failed in my case with

root@:~ # geli resize -s 6441892352 vtbd0p4
geli: Cannot open vtbd0p4: Operation not permitted.

so i rebooted the system and tried the resize operation again.

once again make sure you know the mediasize of the geli consumer before rebooting!

it is not possible to open the geli device after the gpt partition resize operation.

# geli load
# geli resize -s 6441892352 vtbd0p4
#

After rebooting the system expand the zroot pool with

zpool set autoexpand=on zroot
zpool online -e zroot vtbd0p4.eli