What I think is the Core Storage metadata on the primary volume contains an encrypted copy of the DEK. I mean, why put the only copy on another file system and partition? That's risky. I'm willing to bet how Apple does it is similar to a combined LVM+LUKS header, except they appear to duplicate the metadata at each end of the partition. In between that plaintext metadata is a (huge) pile of ciphertext which is the actual primary volume, OS + apps + user data.