Your banking organization is migrating sensitive customer data to Google Cloud. This data is currently encrypted at rest on-premises and is subject to strict regulatory requirements. The chosen encryption strategy must allow you to audit all key usage and have the ability to deny specific types of decrypt requests, independent of the cloud service provider. What should you do to ensure robust security and regulatory compliance?