If you're running in AWS with any secret management service that isn't using CloudHSM, you're trusting AWS with your key material.
There surely is some amount of trust there, though.
There surely is some amount of trust there, though.
Not to diminish your point -- the how/where/when really does matter. Locking your house key in your car is still better than leaving it on your front step, but also not as good as in your pocket.