A financial services company runs a mission-critical Azure SQL Database that stores customer PII. Regulatory auditors require that the organization retain full control over the encryption keys protecting data at rest, including the ability to revoke access instantly, rotate keys on a defined schedule, and produce audit logs of every key operation. The security architect must design an encryption-at-rest solution that meets these requirements while keeping data encrypted transparently to the application. Which solution should the architect recommend?