You're planning to archive sensitive data in Cloud Storage . Due to strict security policies, you want to adopt a "Trust No One" (TNO) encryption model—meaning that even cloud provider personnel should not be able to decrypt the data. Your goal is to retain full control over the encryption keys and prevent unauthorized access, including from the cloud provider itself. What is the most appropriate way to implement this encryption model?