A data service uses provider-managed encryption at rest, but policy additionally requires customer control of supported key lifecycle. Which approach best fits?

1. Enable and validate appropriate transport encryption such as TLS.
2. Verify dependent data and recovery obligations before the approved key destruction.
3. Configure a compatible customer-managed encryption key.
4. Evaluate supported Confidential Computing protections.