A financial services company must comply with an internal policy requiring that the organization retain full control over the lifecycle of the encryption keys protecting its data in Google Cloud, including the ability to rotate, disable, and revoke keys on its own schedule. They are comfortable with Google storing the keys but insist on managing them directly. Which encryption option best meets this requirement?