except if the key to its encrypted-at-rest hard drive is not used to do encrypting/decrypting on same CPU as it’s hard drive (that being, done remotely)