A key whose policy and lifecycle are directly administered by the customer rather than provider-managed defaults.