There's also something fairly basic you can use to mitigate this: mix rdrand's output with some amount of entropy from other sources.

Even if it were done just a little to minimize performance impact, this would greatly increase the difficulty of using such a backdoor if it did exist.

And totally good point about cloud. Any cloud host can trivially observe everything you are doing, steal your keys, etc.