Secure Symmetric key from sa
Can I secure SQL Server symmetric key from [sa] account?


Nope. The best you can do (and should be doing) is to:


Rename SA
Use Windows authentication only
Disable SA (also see #2)


However, SA is just a login. The server roles of sysadmins gives full privileges over the system.

The only way to secure a symmetric key using SQL Server against a sysadmins is to use multiple encryption techniques involving the users and/or the application.

Note that always encrypted and HSMs use Asymmetric keys.


  Can I create symmetric key using local user certificate via MMC? 


That's not going to help you with this issue.