> the implied means of power, the threat of force, rather than by direct military force
Sure, right, that's kinda what I implied with my post. As long as I have access to decrypted bytes in memory and I have access to: my eyeballs + pen + paper, then the jig is up.
The TPM+BitLocker scenario would protect the data on the hard disk and prevent offline attacks and would prevent someone from trying to extract the key from the running OS.
> the implied means of power, the threat of force, rather than by direct military force
Ding ding, exactly. That's why I mentioned "Group Policy". At best, you could attempt to restrict user access to the LIVE mounted decrypted data... but at that point you're trusting the client and a dedicated individual would get around it.
You'd almost need this:
Request remotely-stored invididual encrypted file -> Receive it locally -> Decrypt locally.
which would give you a chokepoint to be able to cut off access to the encrypted data, but there are a thousand problems with this scenario as well, just from a technical standpoint.