Compliance requires cryptographic operations using keys backed by hardware security modules in the managed key service. Which approach best fits?

1. Retain required historical key versions until dependent data and recovery needs are verified.
2. Use Cloud HSM with suitable key configuration.
3. Evaluate Cloud External Key Manager and the service's compatibility and availability requirements.
4. Restore authorized access to the required key and investigate the disabling event.