If I were in charge of collecting encrypted data at the NSA, I would make sure that whatever keys were used by the CPU's AES instruction set would be copied and saved using the CPU firmware. Then that data could be sent out with the ME, or simply stored in case that computer was ever an object of interest. In that way, anything encrypted (using hardware) could be decrypted. Seems like it would be malpractice by the NSA not to collect AES keys at the hardware level.