A defense contractor must protect a small set of highly classified engineering documents so that Microsoft 365 cloud services can never decrypt the content, even during legal or government requests to Microsoft. The organization already uses sensitivity labels with standard encryption for most data. For this narrow set of documents, they require that decryption depend on a key the organization holds entirely on-premises, in addition to a Microsoft-managed key, and are willing to accept that cloud-side services like search, eDiscovery, and DLP inspection will not work on that content. Which Microsoft Purview capability should the architect recommend for these documents?