[Analemma_]

Former AWS employee, this is very much not true. It doesn’t protect against every possible insider threat but does protect against a very large class of them. It is extremely not the case that you can assume an attacker who has access to the disk also has access to the key material, those are two very different things.