Key Management by End User Only

Where encryption is deployed, enable an option for the end user or end customer to maintain their own keys and the host (in this case us) would have no access to them. This is a faster way to satisfy compliance for some policies and also adds a level of "security" in the eyes of end user. Alternatively, if the encryption is tied to the account, then removing the ability for the host (again, in this case us) to perform password resets, would satisfy that as well.