I guess there isn't enough detail to raelly work out what would happen - its not clear that they meant whole disk encryption in the way you described. I thought they encrypt the disk _only_ after loss of communications. The private key is not on the VM anywhere. Thus, the vm once encrypted, is useless (without the passphrase, which presumably only exist in the head of the operator of tpb).