Not quite the answer, but well spotted! It still seems to be just KMS - we can do crypto operations in secure hardware as well.

Thanks!