Google Cloud states that key shares are held in encrypted form and that Google cannot access customers' key material in unencrypted form on its infrastructure.