A team mandates customer-managed keys for supported storage services. Which design is essential?

1. Configure the service's key integration and the required key-use and administration permissions.
2. Assume naming a bucket encrypted selects a customer-managed key.
3. Store the master key in a public object.
4. Give every application user unrestricted key deletion rights.