A healthcare company migrating sensitive patient data to Google Cloud needs centralized encryption key management, controlled team access, and automatic key rotation to comply with security regulations. Which Google Cloud option best meets these requirements?