The coverage is measured into a PCR with the Confidential VM's vTPM (which is matched in The real key launch coverage around the KMS Together with the envisioned policy hash to the deployment) and enforced by a hardened container runtime hosted within just Every single occasion. The runtime screens