A content (one partition of a physical game's rom, or one .app file) downloaded from Nintendo servers is encrypted with a code, which can be calculated by knowing some factors (mainly the titleid of the game and the key selection, factors which are publicly accessible, and its titlekey, which is included in the "ticket" which you're supposed to buy from the eShop - but titlekeys can also be found on certain 3rd party sites)
That is enough to decrypt a game to the point it can be installed
Then, 9.6+ games also have "seed" encryption covering the romfs and the actual executable (this means that among things NOT further encrypted with the seed are the icon and banner), which means - unless the game was fully decrypted (also called "cryptofixing") before installation - that a seed is required to actually run the game... the whole principle behing digital preorders is that you get the files and the titlekey at your leisure, then when the game is launched you can claim the seed afterwards