AWS KMS is a regional service but China is still extra special. With KMS actually the only thing that prevents encrypt/decrypt from anywhere on the Internet is

AWS KMS is a regional service but China is still extra special. With KMS actually the only thing that prevents encrypt/decrypt from anywhere on the Internet is the access control logic of the service. AWS of course hold the private keys for ACM certs too and could provide them upon request. (Side note: the KMS "BYOK" functionality is almost completely useless). Realistically you should expect any cloud-hosted infrastructure to be fully transparent to relevant authorities. This is usually not a business problem.