> There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data.

I believe what you're referring to is homomorphic encryption.

Yes I did mention that technique in my comment upthread. But there is a more simple stupid way: just perform the computation somewhere else, on some server you own, one some server you rent, on some service you rent... From the POV of the device in the field it doesn't really matter.

That is a use case, sure, but this service doesn’t provide computations, only management of keys.

I don't know; I just read what's written on their home page:

    Evervault Cages
    Process the data you encrypt with Relay or our SDK by deploying your code in Cages — isolated serverless functions hosted on Evervault.

    Cages automatically decrypt your data in an isolated environment, so you can still process data without handling it in plaintext.

perhaps I misunderstood what that feature is; if that's true I suspect it's not entirely my fault, but there is something misleading in the product description.

No, you're right, I missed that feature.