Contoso must protect a small set of highly sensitive research documents so that the encryption keys are held entirely by Contoso and are never accessible to Microsoft, while still allowing these documents to be labeled and consumed in Office desktop apps. Which encryption configuration should you implement for the sensitivity label protecting these documents?