Encrypt and Decrypt issues

[CJNabla]

In the ocicrypt.md, follow your tutorial to do image encryption. It is found that the container does not need a secret key when running, so what is the meaning of encryption?

As ocicrypt.md descripts, "No flag is needed for running encrypted images with nerdctl run, as long as the private key is stored in /etc/containerd/ocicrypt/keys (for rootless ~/.config/containerd/ocicrypt/keys)."
I found that even if the private key is not stored in the target, I can still run encrypted images without any flag about encryption.

[AkihiroSuda]

It is found that the container does not need a secret key when running

The key is required for unpacking an encrypted image.
Running an already unpacked image does not need the key.