> where does it get a key to decrypt memory on resume?

you enter it...