Today's paradigm assumes the cloud is the canonical location.

A user's device has to prove to the server that it should be allowed to see the data.

The device has to prove to the cloud that it should be treated like an extension of the canonical territory in the cloud.

But that's backwards!

The cloud should feel like an extension of your computer, not vice versa.

Why not treat the user's device as canonical, and have the cloud prove to the device that it's worthy of being treated like an extension of the device?

For example, proving via remote attestation that it's a Private Cloud Enclave.

The key question about which side is canonical is "where do the user's keys canonically live"?