Design a key management service

Design a service that creates, stores and rotates encryption keys for other services and performs encrypt and decrypt calls for them. Cover how master keys are protected (hardware security modules, envelope encryption), access control and audit logs, rotation without breaking old data, availability across regions, and latency.