Regardless of the key management solution, a significant challenge is to ensure that keys are not mishandled by users. It is critical to disconnect users and developers from key management. Application teams should not be involved in storing, protecting, or rotating encryption keys, and nor should they be allowed to actually possess keys. Instead, they should be provided with key identifiers and an interface to an abstraction layer that automates key generation, retrieval, caching, protection, and refresh.