10-year WORM archive
Every signed e-CF is persisted to an S3 bucket with Object Lock COMPLIANCE
mode and an immutable 10-year retention. After 90 days the object
automatically transitions to Glacier Deep Archive to reduce cost. A
bucket policy denies s3:DeleteObjectVersion as defense in depth on top
of Object Lock.