Permanent storage. The kernelcache is lzss compressed and encrypted with AES. I forget the details of signature verification at the moment, but that is done usi

Permanent storage. The kernelcache is lzss compressed and encrypted with AES. I forget the details of signature verification at the moment, but that is done using RSA. The iBoot bootloader handles all of the decompression, decryption, and signature verification.