they are not sovereign because they're running software developed by a company liable to coercion by the regime
they are not sovereign because they're running software developed by a company liable to coercion by the regime
Doesn't matter if it is a EU subsidiary. The US parent company must abide by US law and give US authorities the data.
EU citizens cannot trust their data in the hands of US companies. No matter if it is on servers in Europe hosted by European subsidiaries.
So the US legal system can say "give us this data" but they don't have access as they are on another company's servers in another company's data center operated by another company's staff.
US institutions don't hesitate to demand their companies to implement secret backdoors in their hardware or software, as evidenced by Snowden's leaks (for Cisco routers) and the Lavabit shutdown (mail company ordered to implement a tap on their clients' data).
Sure, you can have all you described, but how are updates vetted?
But that is adversarial and is to be expected.
At least for these sort of cooperative partnerships that I am aware of in enterprise, there are typically provisions in contracts for code-access, verifiable builds, ability to reject updates and so on and so on. I don't know if these provisions exist in the sovereign cloud contracts that the cloud companies are building, but I would be really surprised if they went to all this trouble replicating Azure/GCP/etc in entirely air-gapped data centers with duplicated staff and hardware and all that, but don't bother to vet the code they get!
These sovereignty products I don't think are just a check-box you can tick to get it, they're separate things and probably cost the earth too.
Only officially public one that I know of: e.g. https://www.s3ns.io/en (but I hear whispers of others)
The EU should really fight these illegal circumventions
Unfortunately critical infrastructure providers flock to that, though there are some exceptions.