Decryption keys are backed into GPU. Learn about how trusted compute works on Nvidia hardware.

This is why for instance Google allow to deploy Gemini models on private GCP instances deployed on air gapped hardware.