I'm investigating TRESOR as a way to prevent stealing of encryption keys from RAM by someone with physical access to the machine.
This seems solid in the case of a dedicated server, but what about a virtual machine? I saw in this answer that TRESOR stores the key in the CPU DR registers, and patches the kernel to tell userland that the number of DR registers is 0.
On a virtual machine however, where are these registers stored when the CPU switches to another virtual machine? Is this a concern?