A critical system's data is encrypted, but all application administrators can retrieve the keys. What should the assessment evaluate?

1. Only the strength of the algorithm
2. Automatic removal of the data from risk scope
3. Whether key access undermines the intended confidentiality boundary
4. The number of encrypted files as proof of low risk