Design secure storage and distribution for producer-supplied cryptographic keys

Design a secure key management service that allows producers (cloud/devices) to store and transport cryptographic keys securely to a backend, with per-key authorization policies, support for multiple consumers, immutable audit records for key decryption events in an enclave, and key rotation capabilities.