Go beyond data sovereignty promises to proof with five CSO controls: zero-trust, local keys, logs, validation and third-party attestation.