AMD EPYC processors already support AES encryption of memory (https://developer.amd.com/sev/) where VMs themselves cannot know the key. Interesting that I didn't see that mentioned in the paper as a possible mitigation.