They will need to store them in plain text or encrypted plain text (which is just plain text with sugar on top) just due to the way some of the VPN protocols they support work.

They should avoid emailing them however, if they can.