Customer-managed keys are not zero-knowledge