The audit log records your account's backup encryption key

Each account's backups, snapshot copies and paused sandboxes stored off the server are encrypted with a key of its own. The audit log now records when Runtime creates that key, rotates it (the old key becomes read-only: it still opens existing backups and encrypts no new ones) and destroys an old key. A key is destroyed only after no backup, copy or replica still uses it. Entries are account.storage_key_created, account.storage_key_rotated and account.storage_key_destroyed.