[crottypeter]

I think the idea is that you never save anything to the disk unencrypted.

Zeroing out is not entirely secure because at the hardware level a newly zeroed bit might be distinguishable from a bit that was already zero.