If a Lightning node needs its keys to be hot to sign transactions & channel updates, and if that node is running on a VM by a 3rd party LSP provider...

How exactly is that node's key NOT in memory in that server? (aka your keys are accessible to the provider)

Enlighten me pls!