A processing device comprising: a multi-key total memory encryption, MK-TME, circuit; an on-chip memory to store a key ownership table, KOT,; and a processing core to execute a trust domain resource manager, TDRM,, wherein the TDRM is to: initialize a trust domain control structure, TDCS, associated with a trust domain, TD,; initialize a trust domain protected memory, TDPM, associated with the TD; generate a one-time cryptographic key; identify an available host key identifier, HKID, stored in the KOT; assign, using the MK-TME circuit, the available HKID to the one-time cryptographic key; store the HKID in the TDCS; associate a logical processor to the TD; add a memory page from an address space of the logical processor to the TDPM; and transfer execution control to the logical processor to execute the TD, wherein the TDRM is further to: stop the TD executing on the logical processor; flush a cache entry of a cache associated with the logical processor, wherein the cache entry stores contents of a memory page of the TDPM; mark, in the KOT, the HKID assigned to the one-time cryptographic key as available for assignment to other one-time cryptographic keys in response to determining that all cache entries of the cache associated with the logical processor have been flushed; and remove the memory page from the TDPM. a multi-key total memory encryption, MK-TME, circuit; an on-chip memory to store a key ownership table, KOT,; and a processing core to execute a trust domain resource manager, TDRM,, wherein the TDRM is to: initialize a trust domain control structure, TDCS, associated with a trust domain, TD,; initialize a trust domain protected memory, TDPM, associated with the TD; generate a one-time cryptographic key; identify an available host key identifier, HKID, stored in the KOT; assign, using the MK-TME circuit, the available HKID to the one-time cryptographic key; store the HKID in the TDCS; associate a logical processor to the TD; add a memory page from an address space of the logical processor to the TDPM; and transfer execution control to the logical processor to execute the TD, initialize a trust domain control structure, TDCS, associated with a trust domain, TD,; initialize a trust domain protected memory, TDPM, associated with the TD; generate a one-time cryptographic key; identify an available host key identifier, HKID, stored in the KOT; assign, using the MK-TME circuit, the available HKID to the one-time cryptographic key; store the HKID in the TDCS; associate a logical processor to the TD; add a memory page from an address space of the logical processor to the TDPM; and transfer execution control to the logical processor to execute the TD, wherein the TDRM is further to: stop the TD executing on the logical processor; flush a cache entry of a cache associated with the logical processor, wherein the cache entry stores contents of a memory page of the TDPM; mark, in the KOT, the HKID assigned to the one-time cryptographic key as available for assignment to other one-time cryptographic keys in response to determining that all cache entries of the cache associated with the logical processor have been flushed; and remove the memory page from the TDPM. stop the TD executing on the logical processor; flush a cache entry of a cache associated with the logical processor, wherein the cache entry stores contents of a memory page of the TDPM; mark, in the KOT, the HKID assigned to the one-time cryptographic key as available for assignment to other one-time cryptographic keys in response to determining that all cache entries of the cache associated with the logical processor have been flushed; and remove the memory page from the TDPM.