Why is key management critical for encryption in PCI DSS?

• A.Poor key custody matters little with AES-256; if one administrator holds the full key in clear text, split knowledge is waived, though assessors may still ask for a written policy
• B.Key management is a documentation task; if keys are stored beside the data they protect, the cipher itself may still satisfy Requirement 3 for each stored PAN in the cardholder data environment
• C.Key management matters for TLS certificates; if one expires, stored PAN may be re-encrypted, though data at rest is unaffected
• D.Without proper key management, encryption can be rendered useless; if keys are compromised, lost, or improperly handled, encrypted cardholder data may be exposed or inaccessible