It just moves the problem, to how do you delete the keys & manage backups of the keys. You have to backup the keys, since a system outage would otherwise leave

It just moves the problem, to how do you delete the keys & manage backups of the keys. You have to backup the keys, since a system outage would otherwise leave you unable to function. My shot from the hip: encryption/keying is irrelevant except for highly sensitive data (credit cards, crypto wallets). Plain deletion from production databases should be sufficient, backups should be "at arms length" but otherwise should not need to be treated specially. Another shot from the hip: System outage & RPO loss of a requested deletion is an act of God and no worse (indeed probably less important) than losing the other business transactions in that time period. I don't see special handling being needed for deletion.