A tenant requests cryptographic erasure of a dataset. What must be established before relying on deletion of its encryption key?

1. Every file has the same extension
2. The dataset has been moved to a cheaper storage class
3. The object names no longer appear in the user interface
4. All recoverable copies depend on keys that can be reliably destroyed