So it's not the actually the key that's easily located, but the key schedule from which you can get the key out easily?

Yes for projects like aeskeyfind

For Volatility we use the TC data structures in memory to lead us to the key (the same ones TC uses to perform reads/writes)