Comment by harvey7

SEV-SNP treats the hypervisor as untrusted. So the only thing that can break it is a bug inside the enclave / hardware.