Trust Math, Not Vendors

Somewhere in a Frankfurt datacenter right now, a processor is running a workload inside a box that the datacenter's own operator cannot open. Not "is contractually forbidden from opening". Cannot: the memory is encrypted with keys the CPU holds, the hypervisor sees ciphertext, and before the workload accepted any data, it produced a cryptographic attestation proving exactly what code was running on exactly what hardware. Every major cloud sells this today under the name confidential computing, on AMD's SEV-SNP and Intel's TDX, with a Linux Foundation consortium standardizing the vocabulary.

This series has spent months arguing that sovereignty is about who can be compelled, not where servers sit, and every answer so far has been legal or structural: entities, tiers, exits. Confidential computing is the technical answer, the claim that math can end the trust problem contracts only manage. The claim is half true, and the half matters enormously: encryption-in-use genuinely removes the operator from your threat model, and the legal problem survives by walking around the cryptography to the places where data must be plaintext and people must hold keys.

What the math actually ends

Understand the before-state to see the size of the win. Classical cloud trust was total: your provider's hypervisor saw every byte of every workload's memory, so every promise about operator access, every "our admins can't", was policy, auditable at best, never guaranteeable under oath. Trusted execution environments invert the physics. Memory encryption enforced by the silicon means the host sees noise; attestation means you verify the enclave's identity and code before entrusting it with secrets, remotely, cryptographically, without asking anyone's marketing department.

That converts a real class of vendor promises into verifiable properties, and the class is exactly the one the Microsoft France testimony made famous: what can the operator be compelled to hand over? For a properly confidential workload, the honest answer narrows to ciphertext and attestation logs, which changes the compelled-disclosure calculus materially. A subpoena served on an operator who can produce only noise is a subpoena that must go find someone else, and "must go find someone else" is precisely the property sovereignty buyers have been trying to purchase with datacenter geography this whole time. The dropdown never delivered it. The silicon, within its limits, does.

Where the law survives

Now the limits, because they're structural, and vendors selling "sovereignty solved" over a TEE logo deserve the same washing test as everyone else.

First, the trust didn't vanish; it moved up the stack and changed nationality. The enclave's guarantees root in the CPU vendor: its microcode, its attestation infrastructure, its signing keys, and the companies holding those roots are American, which means the jurisdiction question this series keeps asking reattaches one layer down. You've exchanged trusting your operator for trusting your chipmaker, a genuinely better trade, smaller surface, verifiable behavior, and still a trade with a flag on it. Second, the side-channel record is humbling: the history of enclave attacks is long enough that "the operator cannot" deserves an asterisk reading "cannot, absent the next paper". Third, and decisive: data doesn't live its whole life in an enclave. It arrives from somewhere and results leave to somewhere, plaintext exists at the endpoints, keys are held by people, and legal process, unable to compel the ciphertext, simply re-aims at whoever holds the ends. Courts don't attack cryptography. They compel its keyholders, and no instruction set extension has jurisdiction over a contempt citation.

There's also the quieter mismatch: regulators want auditability, retention, and answerable humans, wants that pure secrecy doesn't satisfy and sometimes offends. CADA's tiers ask who owns you and who staffs you; a TEE answers neither. The math compresses the trust surface. The law follows the residue, because the residue is where the people are.

The steelman: most of you don't need this

The dismissive case is worth stating plainly. Confidential computing adds real complexity and real cost for a threat, your own cloud provider reading your memory, that appears in almost nobody's actual incident history; the side-channel literature suggests the guarantees are softer than the brochures; and for the median company, the boring controls, encryption at rest, sane IAM, tested exits, retire more risk per euro than enclaves ever will. Sovereignty theater comes in technical flavors too, and a TEE checkbox on a procurement form can be exactly that.

Mostly right, and it sharpens rather than defeats the case. The point of confidential computing isn't that everyone needs it now; it's that it moves a boundary that was previously fixed: the set of things you must take on faith from an infrastructure operator is shrinking, generation by generation, verifiably, and that direction compounds. Ten years ago "the operator can't see your workload" was a lie wherever it appeared. Today it's true with an asterisk. The asterisk is real work, and it's also smaller than last year's asterisk, which is what progress in trust looks like: not trust disappearing, but trust becoming something you check.

So end the series where it started, with the three instruments a sovereignty strategy actually has. Trust math where math can carry it, and verify the attestation rather than the adjective. Read contracts where math can't reach, jurisdiction, custody, compulsion, the places where the residue lives. And keep the exit, the one instrument that works unilaterally, whatever the silicon or the statute does next. Vendors will keep selling each instrument as the whole orchestra. Your job is the arrangement, and it starts with one inventory question: for each sensitive workload you run, which of the three is currently protecting it, and which is just assumed to be?