Yea, that’s why I mentioned these companies are just doing it wrong. Governments have the same problems as private companies, in that they don’t really want to maintain their own cloud infrastructure, so they’ll use something like AWS
But for example they could host their own On-premises HSM and encrypt their GovCloud to a degree that it’s inaccessible to AWS