It seems it may be part of OpenSUSEs move to full disk encryption using TPM/secure boot. There was secureboot before, but now everything but a small FAT partition is encrypted.
They tweaked things so that that an encrypted binary is created and unlocked only by TPM/secure boot, prior to actually running the boot / main kernel stuff. The system regenerates the binary after each load to stay current with the rolling TPM registers.