A company requires strict data residency and encryption controls. They must use AWS KMS for encryption, but the key material must be generated and stored in an on-premises Hardware Security Module (HSM). Which TWO steps are required to implement this? (Select TWO)

Create a KMS key with no key material (external key store).

Use AWS CloudHSM to generate the key material and link it to KMS.

Establish a VPC Peering connection to the on-premises data center.

Download the public key and import token from KMS, encrypt the key material on-premises, and upload it to KMS.

Configure KMS to use AWS Direct Connect to fetch the key dynamically for every encryption request.

Enable S3 Server-Side Encryption with Customer-Provided Keys (SSE-C).