Modern server CPUs have different memory encryption keys per VM, it's how AWS Nitro Secure Enclaves can work.