A processing device comprising: a multi-key total memory encryption, MK-TME, circuit ; an on-chip memory to store a key ownership table, KOT, ; and a processing core to execute a trust domain resource manager, TDRM, , wherein the TDRM is to: initialize a trust domain control structure, TDCS, associated with a trust domain, TD, ; initialize a trust domain protected memory, TDPM, associated with the TD ; generate a one-time cryptographic key; identify an available host key identifier, HKID, stored in the KOT ; assign, using the MK-TME circuit , the available HKID to the one-time cryptographic key; store the HKID in the TDCS ; associate a logical processor to the TD ; add a memory page from an address space of the logical processor to the TDPM ; and transfer execution control to the logical processor to execute the TD , wherein the TDRM is further to: stop the TD executing on the logical processor; flush a cache entry of a cache associated with the logical processor, wherein the cache entry stores contents of a memory page of the TDPM ; mark, in the KOT , the HKID assigned to the one-time cryptographic key as available for assignment to other one-time cryptographic keys in response to determining that all cache entries of the cache associated with the logical processor have been flushed; and remove the memory page from the TDPM . a multi-key total memory encryption, MK-TME, circuit ; an on-chip memory to store a key ownership table, KOT, ; and a processing core to execute a trust domain resource manager, TDRM, , wherein the TDRM is to: initialize a trust domain control structure, TDCS, associated with a trust domain, TD, ; initialize a trust domain protected memory, TDPM, associated with the TD ; generate a one-time cryptographic key; identify an available host key identifier, HKID, stored in the KOT ; assign, using the MK-TME circuit , the available HKID to the one-time cryptographic key; store the HKID in the TDCS ; associate a logical processor to the TD ; add a memory page from an address space of the logical processor to the TDPM ; and transfer execution control to the logical processor to execute the TD , initialize a trust domain control structure, TDCS, associated with a trust domain, TD, ; initialize a trust domain protected memory, TDPM, associated with the TD ; generate a one-time cryptographic key; identify an available host key identifier, HKID, stored in the KOT ; assign, using the MK-TME circuit , the available HKID to the one-time cryptographic key; store the HKID in the TDCS ; associate a logical processor to the TD ; add a memory page from an address space of the logical processor to the TDPM ; and transfer execution control to the logical processor to execute the TD , wherein the TDRM is further to: stop the TD executing on the logical processor; flush a cache entry of a cache associated with the logical processor, wherein the cache entry stores contents of a memory page of the TDPM ; mark, in the KOT , the HKID assigned to the one-time cryptographic key as available for assignment to other one-time cryptographic keys in response to determining that all cache entries of the cache associated with the logical processor have been flushed; and remove the memory page from the TDPM . stop the TD executing on the logical processor; flush a cache entry of a cache associated with the logical processor, wherein the cache entry stores contents of a memory page of the TDPM ; mark, in the KOT , the HKID assigned to the one-time cryptographic key as available for assignment to other one-time cryptographic keys in response to determining that all cache entries of the cache associated with the logical processor have been flushed; and remove the memory page from the TDPM . <EOS>