Don't Trust, Verify: Building End-to-End Confidential Applications on Google Cloud- Google Developers Blog

This post details the architecture and implementation of building end-to-end confidential services on Google Cloud using Confidential Space and Oak Functions. It introduces Oak Session, an open-source library for application-level end-to-end encryption over load-balanced connections, utilizing the Noise framework and attestation for verifiable proof of integrity and workload identity. It explains how to establish trust by verifying JWTs, binding verification keys, session tokens, and container identities, and discusses endorsement strategies for trusted OCI registries.