How would you answer an interview scenario involving encryption and key management in Cloud Security?

A regulated workload requires customer-controlled encryption keys. Explain the architecture and operational controls you would add.