TEEs end up policing caches and indexes here, while authenticated manifests keep the KV store from quietly rolling back.