As long as the key and compute are custodied by the vendor, confidential compute is little more than "trust us, we'll keep your data safe."