Intel Trust Authority offers an operator-independent attestation service that helps provide end users confidence that the TEE provided by the CSP is trustworthy. End users can encrypt their application and not release the decryption key, nor decrypt it until the attestation token is received. End users can maintain their own KMS on-prem or depend on CSP provided key vaults such as Azure Key Vault to manage these encryption and decryption keys. Therefore, KMS is an integral part of the customer solution and Intel Trust Authority is designed to interoperate with it.