Regarding Iraq: Because he cynically played enforcer for a lot of very rich (AKA influential) people who were scared that the US petrodollar hegemony was about to be supplanted by the Euro once people did the maths on Hussein's recent successful pivot to Euro as reserve currency https://ratical.org/ratville/CAH/RRiraqWar.html - notice how the puppet government that was then installed made it one of their first tasks to switch the country's reserve back to USD. The ongoing currency war was and is the actual war behind the "war" (wars).
Regarding Afghanistan: Everyone knew there was just too much "fog of war" to build a slam-dunk case against him for it. At best it would have ended up being framed by media as hand-waving about "wrong country" or "not just that country". I remember scratching my head wildly though when he was spouting his "with us or against us" and "bomb them back to the stone age" rhetoric (and going unilateral - with the help of his Blair poodle - when the UN disagreed). He raced straight past "un-presidential" on his way to "extremely childish" when conflating "surgically remove some known terrorists from their hiding places" with "go all scorched earth on the entire country where they might have last been hiding". There might have been some chance of making a case for recklessness (similar to the distinction between "manslaughter" & "murder") - on the part of a jumped-up cowboy-wannabe playing "war president", all hubristically drunk on the power he effectively inherited from his dad. As mentioned in many of the other comments though the US would never "allow" the ICC to bring such a conviction (undermining what the ICC is for), and any legal attempt within the US would just trigger screams of "you're not a patriot" and "too soon" (still).
If you're only talking about Storage (data at rest) or Network (data in transit) then encrypt/decrypt offsite and never let symmetric keys (or asymmetric private keys) near the VPS, or for in-transit you could similarly setup encrypted tunnels (symmetric/private keys offsite only) where neither end of the tunnel terminates at the VPS. If you're talking about Compute then whatever does the processing inherently needs access to decrypted data (in RAM, cache, etc) to do anything meaningful. Although there are lots of methods for delegating, compartmentalising, obfuscating, etc (like enclaves, TPM/vTPM...) the unavoidable truth is that you must trust whomever owns the base-infra ultimately processing your data. The one vaguely useful way to use "other people's computers" trustlessly is with SMPC (secure multi-party computation) spread sufficiently widely across multiple independent (preferably competing - or even adversarial!) virtual-computation providers, with an "N-of-M keys" policy that avoids any single provider being able to attain a meaningful level of access to your data independently, or being able to view tangible portions of your data while providing functionality during SMPC. That stuff gets super-niche though.