mdi I cannot tell whether this refers just to CE keys or DE keys as well.
Ending a session on a secondary user profile purges only the Credential Encrypted (CE) storage keys tied to that specific profile from memory, essentially putting that specific profile to a Before First Unlock (BFU) state.
mdi If both are purged
Device Encrypted (DE) storage keys cannot be purged from memory if you want to keep the phone on. They are required for the OS to gain access to its own data that it needs to operate.
mdi does that mean that things like alarms cannot run from that profile while it's at rest?
If the app you wish to use for alarms supports Direct Boot (i.e. doing things when the phone/profile is in the BFU state) like as the default Clock app does, it should work. I've gotten my alarms from my user profiles even after a total system reboot when I've set them through the default Clock app. However, given the amount of bugs in the AOSP profile system, I'd suggest testing things out before relying on them. They might or might not work for you, even if you've done everything right.