On the one hand, fair, I hadn't considered that eventuality. Still, I can't imagine a scenario where, "I need to be able to guard against [cloud provider] blobs being left unencrypted for the long-term" that doesn't also include "and protect against two of their internal services being co-compromised".

If I can't trust blobs in a landfill, I wouldn't trust blobs in a landfill that are decrypted by another blob in the same landfill. Just feels like smoke and mirrors that is purely about chasing CTOs and "CYA"-type decisions.