There is on prem office.

Government and 365 is weird.

Non-military entities use “Government Community Cloud”, which is an environment where data is stored in segmented areas of Microsoft data centers, but everything else is on commercial infrastructure.

You absolutely can host keys as a customer.

The Microsoft approach to all of this stuff is insane.