Yes, most BYOE implementations integrate on-premises key management using HSMs. This keeps keys out of the cloud but allows cloud access.