IBM z-mainframes have complete hw assisted total encryption in z14 and later. Keys are not visible to hypervisor, OS or application (code and data) and it's authenticated. Databases, datasets and network traffic can be transparently encrypted using hardware without altering applications.