If I understand this correctly, you're saying that they actually encrypt the message with a single key. Then they encrypt the messages key with the public key o

If I understand this correctly, you're saying that they actually encrypt the message with a single key. Then they encrypt the messages key with the public key of all recipients and send it with the message, so each user can decrypt the message key with the private physically attached to the device and use it to decrypt the message?