How does the ME determine if I’m running an encryption algorithm using a legal compromised key vs running illegal encryption with a non compromised key? And mor

How does the ME determine if I’m running an encryption algorithm using a legal compromised key vs running illegal encryption with a non compromised key? And more importantly how does this ME turned spy actually determine what is encryption and what isn’t? It’d have to determine on the fly if all the operations on your computer were encryption-like because otherwise just tweaking the code so the outputs are identical but the instructions and memory access are vastly different would completely bypass the ME-snitch.