Refer to the exhibit. Which component must be configured on routers for a GETVPN deployment work properly?

GETVPN requires a Key Server to register Group Members, distribute TEK/KEK keys, and push GDOI policy. PE3 serving as Key Server for Customer 2 CEs as Group Members is architecturally correct because GETVPN operates within a single routing domain and each customer segment maintains its own isolated KS/GM relationship.

Placing Customer 1 CE1 as the Key Server positions the KS at the customer edge rather than in the service provider core, which is not the standard GETVPN provider deployment model.

R1 as Key Server for Customer 1 CEs contradicts the exhibit topology where PE3 is the designated core device positioned to manage the relevant customer group's GDOI registrations.

A single PE acting as Key Server for all CEs across all customer segments would merge GETVPN groups across different customer VPNs, violating traffic separation and the one-group-per-policy-domain requirement.