True, neither architecture will ultimately solve the problem of an attacker having absolute control over the lower layer. No way around it.

Federation does has the nice property that it gives you some choice over who controls the infrastructure you use, but in this case it would mean moving to a different country.