3 ms·

Guess who conveniently holds your "secret key" in escrow just like AWS KMS does by default? The provider.