Accepting keys and storing them in memory (never on disk). If a host has encryption mode enabled, and the current user’s role includes cryptographic operations privileges, vCenter Server pushes keys to the ESXi host upon request. See Prerequisites and Required Privileges for Encryption Tasks.

Ensuring that guest data for encrypted virtual machines are encrypted when stored on disk.

Ensuring that guest data for encrypted virtual machines are never sent unencrypted over the network.