Websphere liberty AES256 custom key in xml not secured

Issue Details

From 26.0.0.3 Default key usage is removed from Liberty for usage along with securityUtility command for AES256 encoding of passwords

New Solution delivered in 25.0.0.12 for appending our own custom AES key for encryption of passwords. here is the link below
https://www.ibm.com/docs/en/was-liberty/base?topic=slia-supplying-your-own-aes-256-key-password-encryption

we notice AESKey generated and saving in the XML file is not secured one as below.
<variable name="wlp.aes.encryption.key" value="<base64_key>" />
<include location="/path/to/myAesKey.xml" />

Above value stored in the myAesKey.xml file is not secured, any one who has access will be able to see the aes key though its base64 encoded.

Even though we can control the file with Linux permissions and placing in the secure location, Users who has access to file will be able to edit and view this myAesKey.xml which has AESkey value.

if aeskey value is modified by any means in xml by mistake also, then Complete Application hosted in JVMs will be at threat.

From IBM ,default key wasn't and never revealed the AESkey till date , but here customer solution of aeskey custom key, expecting Users to have AESKey being revealed to everyone !!! why is it so such an flaw design ? Even for Product Users Aeskey Should be secured.

Though at product you are remediating CWE-321: Use of Hard-coded Cryptographic Key / CVE-2025-14923,

and with custom AESkey solution shared will reveal and expose the Endusers AESkey without any protection.

Recommendation from product

Similar to wasnd can we have aeskey value secured and stored with password protected in the keystore file (aesKey.jceks or aesKey.p12 etc) instead of storing in XML file.
https://www.ibm.com/docs/en/was/9.0.5?topic=aes-enabling-password-encryption-server-environment

Please provide any possible secured solution to store the AES key value in the Product instead of xml file.