Is it possible to store Always Encrypted master key an on-premises key vault?
It's always safe to store the Keys in Centralize key vault rather than any on-premises.

For your case, you can try to create your own Custom Keystore provider