Feature Request: AKS App Routing Operator Support for Azure Key Vault Non-Exportable Keys

**Problem:**

The AKS App Routing Operator currently facilitates SSL/TLS termination by retrieving certificates from Azure Key Vault. While this is a valuable feature, many organizations, particularly those with stringent security and compliance mandates, require that private keys for SSL/TLS certificates are stored as non-exportable within a secure key store like Azure Key Vault (often backed by HSMs).

The current mechanism for retrieving certificates from Key Vault via the Secret Store CSI driver primarily focuses on making the certificate and key material available as Kubernetes secrets. This approach can involve exporting the private key from Key Vault, which is not permissible for non-exportable keys. To fully support enterprise security requirements, the operator needs a mechanism to perform SSL termination using private keys that cannot be exported from Azure Key Vault.

**Proposed Solution:**

Enhance the AKS App Routing Operator and its integration with Azure Key Vault to directly utilize private keys stored as non-exportable for SSL termination. This would involve:

- Allowing users to reference a Key Vault certificate or key that is stored with the non-exportable attribute set.
- The ingress controller managed by the operator (e.g., NGINX) or a component working alongside it must be able to perform the necessary cryptographic operations (like decryption during the TLS handshake) by interacting with Azure Key Vault using the non-exportable key reference, without the private key material ever leaving the Key Vault boundary.
- This interaction should leverage secure authentication methods like Managed Identities assigned to the AKS nodes or the operator/ingress controller components, with appropriate Key Vault permissions (e.g., Get, Sign, Decrypt, WrapKey depending on the exact Key Vault operation needed for TLS).

Begin with the AKS App Routing Operator’s Azure Key Vault certificate retrieval path and its Secret Store CSI driver integration, then examine how the NGINX ingress controller handles TLS termination. Define the required non-exportable-key operations, Managed Identity authentication, and Key Vault permissions; done means the certificate and key reference flow and security boundaries are specified and validated.

Written by the indexing model from the issue text.