they simply zeroize and generate a new random encryption key each time a secure erase is done.