> Even if you move all of their code and mandate that they have a shell company in the United States, and you mandate that none of American data ever goes to China, they can ignore you. You validate that every request only stays in the United States? How do you validate that there's no communication between the two systems?

> The state they operate in is going to make whistle blowing very difficult, not ever allow proper auditing into the state apparatus which ultimately controls the company.

You can have auditing and whistleblowing on the US entity (and include a promise of asylum in the whistleblowing protection), and big fines if they ever send data offshore.