Four providers entering a CISPE certification path shows how cloud sovereignty is shifting from branding to testable controls, with law and governance now part of the security stack.