They aren't, how would you encrypt them so the local user could read them but someone with local access couldn't? You'd have to ask the user for a password every time the service started up, which would be terrible UX.