Where do my keys live if I use Self-Defending KMS?

The keys, as well as other types of secrets stored in Self-Defending KMS, are held in an encrypted database when not in use. When in use, the keys are only available inside a secure enclave created using Intel® SGX technology, which ensures that the key material is never available in plaintext to any software component on the node other than Self-Defending KMS itself. This includes the OS, hypervisor, BIOS, co-tenant VMs, etc. Self-Defending KMS-managed key material is also never exposed in plaintext on the system memory bus or on any other physical interface outside the processor package.