How to use client side encryption for Cloud SQL so that only the end user have access to their data?

[ceno]

I have an App running at GCP App Engine which stores data in a Cloud SQL PostgreSQL. Since this App is aimed to be used by various different clients, I need a way to guarantee to them that they are the only ones that have access to their respective data, even when I am the one who manages the cloud services on GCP. The only way I found that this could be achieved is by means of client side encryption (please correct me if I am wrong).

I couldn't find information about achieve this goal with keys been stored locally, only with keys been stored in Cloud KMS (Can this solve the problem?). Here it was just mentioned in the overview.