Time to leverage IBM Cloud KYOK model. You need level 4 especially if you're using 3rd party: FIPS 140-2 Level 4 certified HSM

https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-bas...