Cloud EKM: GCP service: External keys you control </>