You need to secure the Azure Functions to meet the security requirements.

Store the RSA-HSM key in Azure Cosmos DB. Apery the built-in policies for customer-managed keys and allowed locations.

Create a free tier Azure App Configuration instance with a new Azure AD service principal.

Store the RSA-HSM key in Azure Key Vault with soft-delete and purge-protection features enabled.

Store the RSA-HSM key in Azure Blob storage with an Immutability policy applied to the container.

Create a standard tier Azure App Configuration instance with an assigned Azure AD managed identity.