In Chapter 14 we looked at setting up Always Encrypted with secure enclaves using host key attestation. Microsoft recommends using host key mode in dev/test scenarios or where you don’t have a physical TPM (Trusted Platform Module) – though you can use TPM mode in some virtualized scenarios. A TPM is usually a physical chip that sits on the motherboard of your computer, but you can have virtualized TPMs on VMs.
TPM attestation is the more secure form of attestation and allows HGS to verify that your SQL Server ...
