eFuse
One-time-programmable bits inside the ESP32; once burned they can't be changed, and key blocks can be made unreadable.
An eFuse is a one-time-programmable bit in the chip; ESP32 eFuse key blocks can be read-protected so that only the hardware crypto engines, not software, can use the key stored there.
Examples
The ESP32's factory MAC address lives in eFuse, and a key burned into a read-protected eFuse block can be used by the chip's own hardware but never printed by firmware.
See also