they are not sovereign because they're running software developed by a company liable to coercion by the regime
Doesn't matter if it is a EU subsidiary. The US parent company must abide by US law and give US authorities the data.
EU citizens cannot trust their data in the hands of US companies. No matter if it is on servers in Europe hosted by European subsidiaries.
So the US legal system can say "give us this data" but they don't have access as they are on another company's servers in another company's data center operated by another company's staff.
US institutions don't hesitate to demand their companies to implement secret backdoors in their hardware or software, as evidenced by Snowden's leaks (for Cisco routers) and the Lavabit shutdown (mail company ordered to implement a tap on their clients' data).
Sure, you can have all you described, but how are updates vetted?
The EU should really fight these illegal circumventions
Unfortunately critical infrastructure providers flock to that, though there are some exceptions.
