[wiredfool]

I didn't expect this to happen nearly this soon. What it means to me is that I can replace a locked cabinet @ colo with EC2, and not have PCI throw a rod if backups are stored on S3 (assuming suitable key management).

What it doesn't help is the dual control and change control issues. I'd love to know how small startups deal with the dual control issue. Ultimately there's going to be a sysadmin somewhere who can read memory, and once that happens, it's single control. Though, not having access to the physical hardware on EC2 makes it a bit more secure from the sysadmin.