AWS Payment Cryptography enhanced its service by adding Physical Key Exchange, a PCI PIN and P2PE compliant method which supports paper-based cryptographic key exchange. This allows organizations to circumvent maintaining costly Hardware Security Modules (HSMs) and Key Loading Devices (KLDs) for rare key ceremonies when partners do not support electronic exchange.
With this feature, paper key components are sent to AWS-trained custodians who perform secure key ceremonies in AWS facilities adhering to PCI security standards. After loading, the keys become available for cryptographic operations in the cloud service, facilitating migration and compliance needs even when counterparties lack electronic key exchange capability.
Source & further reading
AWS Payment Cryptography now supports paper-based key exchange ↗Source published 2026-04-30. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.