[comex]

The kernel and the root FS are now unencrypted - but not other things, such as the bootloaders (iBoot, LLB) and the firmware for the SEP (Secure Enclave Processor, used to handle things like Touch ID).