IBM z-mainframes have complete hw assisted total encryption in z14 and later. Keys are not visible to hypervisor, OS or application (code and data) and it's authenticated. Databases, datasets and network traffic can be transparently encrypted using hardware without altering applications.
AMDSEV/SME or Intel SGX/TME/MKTME or whatever other HW encrypted page support exist are buggy, which cannot be patched. E.g. AsyncShock
https://github.com/vschiavoni/sgx-papers
This is a SW-only solution, and therefore is probably also buggy, but can be patched and only accessed via ring < 0. Only via yet unknown kernel bugs (patchable) or the mythical ME or ASP/PSP backdoors.
https://semiaccurate.com/2017/06/22/amds-epyc-major-advance-...
And Intel apparently has MKTME, as mentioned in the link for possible hardware implementations: https://lwn.net/Articles/776688/
SEV is an extension to the AMD-V architecture which supports running encrypted virtual machine (VMs) under the control of KVM. Encrypted VMs have their pages (code and data) secured such that only the guest itself has access to the unencrypted version. Each encrypted VM is associated with a unique encryption key; if its data is accessed to a different entity using a different key the encrypted guests data will be incorrectly decrypted, leading to unintelligible data.