That depends on what you are protecting, but in general if you are high-value enough that it's worth it for somebody to try to attack you through VM instances s

That depends on what you are protecting, but in general if you are high-value enough that it's worth it for somebody to try to attack you through VM instances sharing the physical machine, you should be managing your own hardware and using physical HSM's to protect keys.