Is cloud data sovereignty all just a case of ‘Trust me, bro’?