You need to secure the Azure Functions to meet the security requirements.

Store the RSA-HSM key in Azure Key Vault with soft-delete and purge-protection features enabled

Store the RSA-HSM key in Azure Blob storage with an immutability policy applied to the container.

Store the RSA-HSM key in Azure Cosmos DB. Apply the built-in policies for customer-managed Keys and allowed locations

Create a standard tier Azure App Configuration instance with an assigned Azure AD managed identity.

Create a free tier Azure App Configuration instance with a new Azure AD service principal.