In your organization's Google Cloud environments, there's a requirement for complete control over encryption keys used for data at rest. These keys must originate and be stored outside of Google and seamlessly integrate with various Google Services, including BigQuery. What is the recommended course of action?