Thanks Leif. That's a really nice question. The "under sole control" means that only the signer should be able to access and manage the key. This can only be achieved technically if the signer is in possession of the key. This is now a hot topic due to the Schrems II ruling and the new EDPB guidelines for data transfers where "sole control" is also mentioned. There, the definition of sole control is inline with this reasoning of possessing the keys.