"Usually"

Sure.

But there are custoner managed keys which do exactly what I think it does.

And we here in Canada still ashamed of residential schools. You'd think other countries would have learned.

Wow. I used to be a lead Enterprise architect for a large corporation. We had some clients who explicitly required, by contract, that the data should be hosted in Canada and only accessed by people in Canada. This included the department of National defense.

Microsoft complied by hosting instances in Canada and we went through hoops to ensure data remained in Canada.

This seems to uppend the game. However, all this information should already be encrypted. Whenever it isn't, I'm sure corporations are scrambling to fully encrypt (or de-host) data.

I mean, data (at rest and in transit) encryption has been available for other risk vectors. This seems to be no different. If Microsoft/Amazon/Oracle, etc had a backdoor to unencrypt the data, it would create a higher backslash.

For individual users, I don't think 99% of them care where their data is hosted.

Really? I guess everyone was 15 at some point and hadn't heard that distro wars are useless 🤣

There is no best. Period.