They are encrypted with a SEP key when stored in preboot volume.