If anyone has successfully used Bring Your Own Key (BYOK) in the cloud:  Which Hardware Security Module (HSM) or key management method did you use, and with which cloud service provider(s) (CSP)?  Any advice to an organization considering this option?

We have looked into doing this with Azure, AWS, Salesforce and Google Workspace using technology from Thales called Ciphertrust (and specifically Ciphertrust Cloud Key Manager), though we didn't actually move forward due to shifting priorities and budgets. The technology itself works fine, but do be aware that the pricing approach can be tricky if you have very large numbers of AWS accounts / Azure subscriptions / GCP projects to deal with.

I think the main thing when dealing with BYOK is to ensure that everyone is clear about what you are and are not buying in terms of security. Most people are convinced that BYOK is a magical means to protect against all sorts of threats. Sure, it's a useful thing from a compliance perspective if you need to tick a box saying "we are encrypting with keys we manage ourselves", but in terms of real added security value beyond what you get with the native cloud encryption (without BYOK) there just isn't much. All those cloud vendors have robust encryption platforms, and if you're concerned that the platforms have some kind of government-agency backdoor in them, BYOK won't really help, and it's much the same for Hold Your Own Key (HYOK).