> so we’re going to need to impose regulatory requirements surrounding e.g. key storage and access

This is the part that I said I knew I'd disagree about scale. ;)

Instead of hoping for any kind of "imposed" solution, I'd rather prefer a myriad of different providers and wait to see what patterns emerge and what becomes the best practices. Bottom-up, evolutionary approaches always beat top-down designs in the long run.