> * Built-in integration with external KMS service

The first thing I notice is that Tink doesn't support Azure Key Vault.