Maybe read the post before commenting? They answer all your points in it. The proxy layer is self-hosted, the UI can be self-hosted and the keys are your own A

Maybe read the post before commenting? They answer all your points in it. The proxy layer is self-hosted, the UI can be self-hosted and the keys are your own AWS KMS keys.