In addition, it looks like the "Fanboy’s Annoyance" filter list also blocks the wikipedia fundraising, as well as a bunch of other crap across the internet.
- the drive can request the key on each boot
- the drive stores the key in the firmware, but part of the de-provisioning process would be to reset this key
Does AWS not already do full-disk encryption transparently on their side?
If they do, I trust them to be good stewards of their keys. If not, then why not? I don't know about the enterprise part of the market, but I know consumer SSDs come with encryption permanently enabled in the firmware.