A financial services company stores encrypted customer records in an IaaS environment. During a compliance review, the auditor notes that while the data is encrypted with a strong algorithm, the cloud provider's administrators technically have the ability to retrieve the encryption keys from the provider-managed key store. The security team must eliminate the risk that provider personnel could decrypt customer data while still using the provider's storage services. Which approach BEST addresses this concern?