The encrypted volume has an encrypted copy of the `~/.identity` file in it's metadata fields. The same key which encrypts the volume decrypts the metadata, but

The encrypted volume has an encrypted copy of the `~/.identity` file in it's metadata fields. The same key which encrypts the volume decrypts the metadata, but they use different IVs. You could assume that most systems the key would be secured with the TPM so this won't be much of a big deal to the user, but otherwise when they try to login it would prompt for this password first.