Operational and governance controls for protecting key ownership, approval workflows, and emergency recovery.