> Key is in memory at all times after boot on all of those.

I would think it would have to be while the device is mounted and OS locked, but surely if you dismount a secondary disk/container the key is purged?