> where does it get a key to decrypt memory on resume?