Encryption Strategy and Key Management Questions

Explain when and how to apply encryption for data at rest and data in transit, including selection of algorithms and cipher suites, transport security configuration, and envelope encryption patterns. Cover key lifecycle and key management practices such as secure key generation, storage, rotation, revocation, recovery, separation of duties, and auditability. Discuss certificate management, use of hardware security modules or managed key services, integration with secrets management, performance and operational tradeoffs, and compliance considerations for protecting sensitive data.