Compliance requires cryptographic operations using keys backed by hardware security modules in the managed key service. Which approach best fits?

1. Use Cloud HSM with suitable key configuration.
2. Restore authorized access to the required key and investigate the disabling event.
3. Retain required historical key versions until dependent data and recovery needs are verified.
4. Evaluate Cloud External Key Manager and the service's compatibility and availability requirements.