To your second issue/question, all the cloud provide CMEK services/features (for many years now).