A healthcare analytics company stores patient records in BigQuery and must comply with regulations requiring that the organization retain full control over the encryption keys, including the ability to revoke access and disable keys on demand. Their security team wants to manage the key rotation schedule and be able to audit all key usage. Which approach should the data engineering team implement to satisfy these requirements with the least operational overhead?