I am not an expert, but that's like saying that your root password is accessible to a provider - it is not

the HDD content could be - that's why encrypting your HDD comes into place.

however, to decrypt it, you'd still need the keys, and those keys still would not be accessible to the provider

you probably wonder how it is done - now I do too

when talking about passwords, what is held on the server is a hash that is compared with the hash of what you enter (as a password)

has itself won't open anything but matching hashes will

maybe that's something similar for the keys?

or probably even more sophisticated