Suppression Lists' schema cannot be modified and they always come with both Email Address and Subscriber Key field.
Auto Suppression Configurations on the other hand work by email address exclusively.
About Suppression lists:
So, if you have Subscriber Key enabled, do they use subscriber Key or Email Address? ->
The answer is Subscriber Key.
This is documented explicitly in a bit of an odd place, namely in field level encryption:
Use subscriber key values to suppress subscribers in Marketing Cloud Security and Encryption products.
Can I still use suppression lists [when using field level encryption]?
You can use subscriber key values to suppress subscribers
Suppression Lists use subscriberKey, that documentation just confirms they would even do so after you encrypted said key.
- implicitly, the documentation also mentions it in the "right" location as it says
A suppression list is a list of subscribers
...and subscribers are defined by their Key.
- Also, this document here
shows what the data structure of a suppression list is, when it instructs on how to mirror data inside it into a data extension. Subscriber Key is the primary key, email is not. This alone doesn't prove anything, but it is consistent with the descriptions above and makes perfect sense with subscriber key being used for the suppression: