[iLoveOncall]

Maybe read the post before commenting? They answer all your points in it.

The proxy layer is self-hosted, the UI can be self-hosted and the keys are your own AWS KMS keys.