“With FileVault turned on, the same VEK is used, so the volume doesn’t have to be decrypted and re-encrypted to use FileVault, but the VEK is protected by additional encryption using your password with a hardware key.”