Every system that stores sensitive data needs keys that never leave a hardened boundary, an audit trail of every use, and rotation that doesn’t mean re-encrypting petabytes. On Google Cloud, that’s Cloud KMS; on AWS, it’s AWS KMS. Both store symmetric and asymmetric keys, both use HSMs, and both are built for envelope encryption.