> No one's suggesting Amazon is actually going to spy on your business's bits and bytes (which are already encrypted anyway, right?) ...

I don't get it. If I use the data in any way other than simply storing and retrieving it, I'd expect the decryption keys (ignoring very few situations, in which we are able to compute on encrypted data) to reside on the machines that provide the service, which are posited to be on EC2. So how does encryption protect anything from Amazon?