You can create Salesforce keys as cache-only keys.

• Creating external named credentials
• Enabling cache-only keys
• Creating cache-only keys

When you create a cache-only key in CSP Vault, it creates a new tenant secret in Salesforce, but specifies no key material. Instead, the Cryptographic Security Platform Vault for Cloud Keys provides Salesforce with:

• The CloudKey GUID to use in callouts
• The name of the wrapping certificate it will use
• The named credential to use to retrieve the key