Comment by davidczech

They are encrypted with a SEP key when stored in preboot volume.