[oittaa]

My understanding is that everything is encrypted by default in GCP. Though you need to manually configure encryption keys if you want to prevent Google ever having access to your data.

[FooBarWidget]

This I don't understand. Even if you configure KMS, those are still keys stored on Google infra.

[oittaa]

You can use your own KMS outside the Google infrastructure. https://cloud.google.com/storage/docs/encryption/customer-su...