A financial services company must store cryptographic keys used to encrypt customer data at rest. Regulatory requirements mandate FIPS 140-2 Level 3 validated hardware, single-tenant isolation of the key material, and the ability to import keys generated on-premises (bring your own key). You must recommend a key management solution in Azure that meets all requirements while minimizing operational overhead. What should you recommend?