Comment by LinuxBender

This does not really answer your question but there just isn't a good answer given most VPS providers can live-snapshot and live-migrate nodes despite not making that a service. If something is in memory it's under their control regardless of any magical memory encryption implementation providers claim to use.

Use something you control vs. something managed. In other words do not use a VPS and instead send small throw-away servers to low-end colocation sites. Seal the servers by filling them with black epoxy and pre-configure them to be low-power and thus low-heat and "plug-and-play" so that you can just ship them to the colo, they rack mount and it just turns on, gets DHCP information and "just works". Disable all logging and run everything in ram when it boots. Physically remove all solder from all ports except the one ethernet port you wish to DHCP from and sever the board traces. Use a custom BIOS that removes all JTAG debugging and out of band management. Have a DNS query in cron that makes an obscure request to an "all clear" zone. If that DNS entry vanishes the box assumes duress and zeros out ram and storage. When it fails tell them to trash it. Do not send them a replacement as they may have destroyed it trying to get your data. Just let that account fade away. Bonus if you can put the box on the internet without any accounts or business relationships.

None of this is my idea or a new idea. This is not too different than how Akamai CDN devices worked in shared datacenters minus the black epoxy. The black epoxy was used in an early satellite TV decoding box in the 1980's that people eventually learned to drill in the right spots to get free premium channels and porn before people obtained media from the internet. Many decoders were destroyed in this learning process. VideoCipher II has quite a history. Spies and prisoners hide servers in crawl spaces and manage to get them connected to the internet all the time.