How does an encrypted wallet persist used keys from "getnewaddress" and the keypool after a restart? I'm reading this wiki on wallet encryption  and am confused on how I can call getnewaddress as described here and where that is being tracked after a restart of bitcoind.


  When a wallet is encrypted, the passphrase is required to top up the
  keypool, thus, if the passphrase is rarely entered, it is possible
  that keypool might run out. In this case, the default key will be used
  as the target for payouts for mining, and calls to getnewaddress and
  getaccount address will return an error. In order to prevent such
  cases, the keypool is automatically refilled when walletpassphrase is
  called with a correct passphrase and when topupkeypool is called
  (while the wallet is unlocked). Note that the keypool continues to be
  topped up on various occasions when a new key from pool is used and
  the wallet is unlocked (or unencrypted). 
  
  When wallet passphrase
  enrcyption becomes enabled, any unused keys from the keypool are
  flushed (marked as used) and new keys protected with encyption are
  added. For this reason, make a new backup of your wallet so that you
  will be able to recover the keys from the new key pool should access
  to your backups be necessary.
You can't call it an infinite number of times. In fact, with default settings, the 101st call will fail.

While the private keys that control the bitcoins are encrypted, the addresses corresponding to those keys are not.