A policy requires encryption keys to remain under an approved external key-management system for a supported Google Cloud integration. Which approach best fits?

1. Retain required historical key versions until dependent data and recovery needs are verified.
2. Restore authorized access to the required key and investigate the disabling event.
3. Evaluate Cloud External Key Manager and the service's compatibility and availability requirements.
4. Use Cloud HSM with suitable key configuration.