Is Azure truly locked out from access to the decryption keys and access the unencrypted data (whilst being run against a model)? I followed the link but didn't find these details regarding their security model