Which of the following describes a component of Public Key Infrastructure (PKI) where a copy of a private key is stored to provide third-party access and to facilitate recovery operations?

Key registry is not a standard PKI component - there is no formally defined PKI element with this name for private key storage.

A recovery agent is the person or role authorized to perform key recovery operations, not the storage mechanism or repository where the key copy is held.

A directory (such as LDAP) stores publicly accessible PKI artifacts like certificates and Certificate Revocation Lists, not copies of private keys.

Key escrow is the deliberate practice of depositing a copy of a cryptographic private key with a trusted third-party agent or authority. This design allows law enforcement, employers, or recovery agents to access encrypted data under defined conditions, and is a critical component of enterprise key management and disaster recovery planning within PKI frameworks.