What is the best way to ensure that all data has been removed from a public cloud environment including all media such as back-up tapes?

Allowing the cloud provider to manage keys grants the CSP independent access to plaintext data and creates dependency on the provider's willingness to delete, undermining the customer's control.

Integration of Duties (IOD) is not a recognized security principle, and granting all users deletion rights is the opposite of least-privilege access control, increasing the risk of accidental or malicious data loss.

When customers manage their own encryption keys and revoke or delete those keys (B), all encrypted data - including residual copies on backup tapes held by the cloud provider - becomes permanently inaccessible because no entity retains the ability to decrypt it. Keeping keys stored on the client side (D) ensures the CSP never independently holds plaintext access, preventing unauthorized retrieval. Together, these two controls implement cryptographic erasure, which NIST SP 800-88 recognizes as the appropriate sanitization method when physical media destruction is not possible.