content: It means that if it is not booted, physically obtaining it won't lead to any data leaks.  It's like a super LUKS.  Except with LUKS someone could tamper with the machine making it possible to read the ram while it's running or inject code. Also it isolates nearly every process to it's own vm making it difficult for a network attached process to obtain data.  Also making it difficult for any process to obtain data in theory.