1. A method comprising: with a computing system, exiting a context of a virtual machine, the exiting in response to a request to switch from a first encryption key identifier for the virtual machine to a second encryption key identifier for the virtual machine; with the computing system, loading the second encryption key identifier into a virtual machine control module associated with the virtual machine; and with the computing system, after loading the second encryption key identifier, entering the context of the virtual machine.