Whitepaper: Hold your own key with Google Cloud External Key Manager