MPS3 encrypted MCC BIOS

I'm using an MPS3 evaluation board, and I'm trying to understand how it works. I understand that it requires that the provided MCC BIOS (mbb_version_.ebf) be present on the SD Card, and that it's encrypted, but I don't understand why. What does this BIOS do specifically, and why does ARM encrypt it? Where is the encryption key, and what is the mechanism that decrypts it and where does it go after it's decrypted?

Thanks!