Data loss prevention with key usage limit enforcement

A computer-implemented method, comprising:

• intercepting, at a first network destination on a network that is between a first system and a second network destination on the network, one or more transmissions from the first system and comprising a data record to be stored at the second network destination;
• determining that the data record is encrypted;
• and
• determining, by a second system at the first network destination, that the one or more transmissions are invalid as a result of either:
• an attestation indicating that the first system has an invalid state, or
• a policy encoding information identifying that a digital signature associated with the data record indicates use, of a cryptographic key to generate the data record, that is outside of a usage limit for the cryptographic key;
• and
• initiating, by the second system, a corrective action associated with the data record.

A non-transitory computer-readable storage medium having stored thereon executable instructions that, upon execution by one or more processors of a computer system, cause the computer system to:

• enforce one or more policies encoding information that indicates a usage constraint on a first cryptographic key;
• obtain an encrypted data record, the encrypted data record generated based in part on the cryptographic key and associated with a data storage system that stores data records;
• generate, based in part on a second cryptographic key and the encrypted data record, a digital signature of the encrypted data record;
• and
• transmit the encrypted data record and the generated digital signature to be stored at a network destination to cause an enforcement component separate from the computer system and the network destination to determine, as a result of the one or more policies indicating that the digital signature is invalid, a corrective action in connection with the encrypted data record and corresponding to the one or more policies, the digital signature being invalid on a condition that the encrypted data record is generated outside of compliance with the one or more policies.