We should probably allow tenant admins to override this (RESTRICTED), in case they insist on using their own key.