Picture bellow illustrates how you can use your Raspberry Pi 4 as macsec keying source and router between untrusted segment of your home lan and high security segment, protected by macsec layer2 encryption. There is strong cryptographic separation between unsecure LAN (red) and secured macsec segment (blue). Note that computers on macsec segment has no IPv4/ipv6 address from broadband router.