Encrypting Data with user + custodian private keys
I gave this some more thought over the weekend and came up with a simpler solution. We'll store the data encrypted with the user key. For in-transit encryption we'll use a service key. The user data will be decrypted on read with the user key and then re-encrypted with the service key before transmitting the data. The data consumer will be required to have access to the service key to read it. This will also meet the requirement that the data will be rendered unrecoverable by deleting the user key.