It requires decryption by means beyond the sole supply of a user-owned key. That doesn't require a manufacturer to be capable of decrypting it.

I suspect that there are many ways that can be achieved, all technical ;-)