kernel panic due to missing root when using boot environments

I have a system running 12.3p6 with a GELI+ZFS root configuration that 
had a kernel panic on reboot because it wasn't mounting root correctly.

The system has two pools involved in booting:

bootkey: contains the UEFI partition, /boot, and the GELI keys for the 
devices under the nvme pool
nvme: contains everything else

Previously, the system set vfs.root.mountfrom in loader.conf.  Then I 
reconfigured to use boot environments:

# zfs get -s local all nvme/ROOT/freebsd12
NAME                 PROPERTY              VALUE                  SOURCE
nvme/ROOT/freebsd12  mountpoint            /                      local
nvme/ROOT/freebsd12  readonly              off                    local
nvme/ROOT/freebsd12  canmount              noauto                 local

# zpool get bootfs
NAME     PROPERTY  VALUE                SOURCE
bootkey  bootfs    -                    default
nvme     bootfs    nvme/ROOT/freebsd12  local

With these settings, the kernel panics and reboots before it launches 
userland.  I can't grab a log of the panic, but fast eyeballs caught:

panic: no init

Reboot again, set vfs.root.mountfrom manually from the loader prompt, 
and it boots fine.

Thus a few queries:

1: In a configuration where the boot pool and root pool are not the 
same, how do I set bootfs?  The obvious options of setting it the same 
on both pools or at least the boot pool won't work:

# zpool set bootfs=nvme/ROOT/freebsd12 bootkey
cannot set property for 'bootkey': 'nvme/ROOT/freebsd12' is an invalid name

1a: Why is the setting format bootfs=pool/dataset if I can't specify a 
different pool than the one on which I'm setting bootfs?

2. Why did the kernel panic instead of dropping to the mountroot prompt? 
  Is it because the kernel assumed the filesystem containing /boot was / 
in absence of vfs.root.mountfrom and bootfs so there was no attempt to 
mount / to fail into the mountroot prompt?