I have a Progressive Web Application (PWA) with a lot of users, each user creates a public-private keypair and wants to use that across devices simply by logging in using some form of auth, for example, Google SSO, etc. If there was some sort of secure cloud key vault (from one of the big companies like the ones that are identity providers) that allows a user to store or encrypt/decrypt a private key using that Google SSO auth - the device A could store and device B could fetch the keypair from there, or encrypt the pair and store it on my servers.
I wouldn't have any way to access that keypair in principle - and that's what I want, only a user and a vault manager should have access to that. I couldn't find a readily available answer on whether Amazon KMS admin or Azure Key Vault admin can encrypt/decrypt data using user's keys, but that's probably the case - and that is what I absolutely don't want.
I'm aware of the solution some apps like WhatsApp and Telegram do - they don't use any cloud and just use/transfer the keys by scanning QR codes - but it's a hassle for the user, and simple Google login is easier - and I'm trusting Google anyway. I don't want any additional UI for the user, you logged in on the other device - you can instantly use your keys there - the UX should be as simple as possible.
P.S. I'm also aware one can do this by having a user remember a master password, and encrypt the sensitive data using that password and upload the encrypted blob to my server, however this is worse than just clicking Sign-in with Google/Facebook/etc. and we don't want that either.