Whole disk encryption. How can the kernel be encrypted?
At the most basic level, Apple controls the firmware and stores the absolute minimum information needed to present the illusion that an OS is running at the pre-boot log in screen when FileVault is enabled.

This is documented quite extensively by Apple:


https://support.apple.com/en-us/HT201159 - Product security certifications, validations, and guidance for macOS
https://support.apple.com/en-us/HT204837 - Use FileVault to encrypt the startup disk on your Mac
https://support.apple.com/en-us/HT208862 - Mac Computers that have the T2 chip


Prior to the T2 chip which serves as a sort of trusted module to authenticate if the OS being booted is properly signed / encrypted and/or not tampered with, this pre-boot information can be stored in NVRAM as well as the EFI / recovery HD which don’t get encrypted with a key that needs a user password/passphrase to unlock the main storage.

When you change the background or users that are allowed to unlock FileVault - this cached data is saved outside the encrypted portion of the disk so we are presented with the icons and graphical log in screen. When I see Apple say the startup disk is encrypted, I take that to mean the Macintosh HD logical volume only which stores all user data and all OS but not the firmware and pre-boot data. (except for the T2 chip enabled hardware which are special cases and not the norm yet)

You can confirm this with either commend below based on whether your OS supports APFS and APFS containers which is the new standard for volumes and encryption or HFS+ and Core Storage containers.

diskutil cs list
diskutil apfs list


The other exciting change that’s in progress relating to the T2 chip on the new MacBook Pro and the iMac Pro is that it can enforce encryption to the internal storage whether or not anyone takes the second step of FileVault encryption. Specifically, it will generate an encryption key and start encrypting all data before the user account is even created. An SSD from any of these will not be readable if taken to another computer whether that computer has a T2 chip or not. The keys needed to decrypt the entire drive are stored solely in the Secure Enclave.