A financial services company already uses Google Cloud's default encryption but now needs to create, rotate, and manage its own encryption keys from a centralized location to meet an internal governance policy. Which Google Cloud service should the team use to store and manage these cryptographic keys?