Can you please elaborate? I haven't seen any info from AWS to that end, and with KMS they control the keys.