"Key escrow" by encrypting secrets yourself with trusted tools and storing the result in various object stores. Problem solved. Also solved by on-prem secrets

"Key escrow" by encrypting secrets yourself with trusted tools and storing the result in various object stores. Problem solved. Also solved by on-prem secrets and password managers without cloud features or dial-home. Trusting a new third-party with their new and likely unproven construction is a recipe that has failed spectacularly over and over again. It's possible, but it's very, very difficult and, like email or DNS, becomes a kind of commoditized utility that rarely/never changes.