How to prove to auditors that no employee can access your customers' keys

Here is how to set up key custody where no employee has a technical path to your customers’ keys, the checks an auditor can run without trusting you, and the limits you should tell them about.