The frontend never expects or displays decrypted keys after save.
That separation matters because verification products often need temporary access to provider credentials while still minimizing the long-term secret footprint.
BYOK security should still be evaluated as an operational discipline: check retention behavior, report access controls, and whether the service can prove that reusable secret storage is avoided.