An organization plans an encrypted cloud workload whose threat model includes provider administrators reading memory. Which additional capability should it evaluate?

1. Increasing the number of application replicas
2. Confidential computing with a suitable attestation and key-release design
3. Storage encryption alone with unrestricted runtime access
4. A public website certificate without runtime controls