I want to be able to have a private user key (system generated) which, if destroyed, effectively renders all user data unrecoverable. This key would be used across the entire system to protect the user's data. Instead of having to implement and maintain integrations across all systems to delete a user's sensitive data we could just delete the key, rendering the data useless. However, the problem with this is that there is no granularity: the system has multiple custodians and each custodian should be able to determine who has access to decrypt the message.
We've been using KMS data keys for envelope encryption so the system must have permission to decrypt the envelope key before they can decrypt the message. I was hoping to be able to do something similar but incorporating the use of a user-specific key.