Question

A financial services company needs to digitally sign software release artifacts so that downstream consumers can verify authenticity and integrity without ever having access to the private signing key. The security team wants Google Cloud to generate and store the private key material such that it can never be exported, while allowing external partners to obtain the public key for verification. Which Cloud KMS approach should they implement?

Accepted Answer

Create an asymmetric signing key (key purpose ASYMMETRIC_SIGN) in Cloud KMS, sign artifacts with the private key version, and distribute the retrievable public key to partners for verification.

Answer

Create a symmetric encryption key in Cloud KMS and share it with partners over a secured channel for verifying signatures.

Answer

Generate the key pair locally with OpenSSL, import the private key into Secret Manager, and email the public key to partners.

Answer

Create an asymmetric decryption key (key purpose ASYMMETRIC_DECRYPT) and have partners use it to decrypt and validate the artifact hash.