A financial services company must store cryptographic keys used to protect regulated customer records in Azure. Compliance mandates that keys be generated and stored in single-tenant, FIPS 140-2 Level 3-validated hardware that the cloud provider cannot access, and the design must support customer-managed keys (CMK) for Azure Storage and Azure SQL Database encryption. Which key storage solution should the architect recommend?