An Azure Function must sign data with a key that must never leave the vault. Which operation supports this?

1. A Download the key and sign locally
2. ✓ B Call the Key Vault sign operation so the private key never leaves the service (correct answer)
3. C Store the key as a secret
4. D Export the key to the function

Shortcut: Cryptographic operations such as sign, verify, wrap, and unwrap execute inside Key Vault. Non-exportable keys therefore never appear in application memory.