Universal Containers (UC) would like to store an encryption key within Salesforce for use in Apex code, but it does not want users to be able to see…

Protected custom metadata types are specifically designed for this use case. When a custom metadata type's visibility is set to protected and it is included in a managed package, its records are not visible in the subscribing organization's user interface, including the Setup menu. This restriction applies even to users with the "View Setup and Configuration" permission. However, Apex code that is also part of the same managed package namespace can access the records and their fields. This mechanism allows developers to securely store secrets like encryption keys that are needed for application logic while keeping them completely hidden from all users in the subscriber org.

A: The "View Setup and Configuration" permission grants users the ability to see all custom metadata types and their records, overriding any profile-level restrictions. This would expose the key.

B: The protected visibility setting for custom metadata types is enforced through the namespace of a managed package. Unlocked packages do not provide the necessary encapsulation or namespace protection to hide the records.

1. Salesforce Help, Custom Metadata Types: "If a custom metadata type is in a managed package and has its visibility set to protected, the metadata type is directly accessible only by Apex code in the same managed package namespace. Subscriber orgs can’t see the type or its records in Setup."

2. ISVforce Guide, Second-Generation Managed Packages, Component Behavior in Packages (Page 10): This guide details how different components behave in packages. For protected components, it states, "The component is not visible in the subscriber’s org, but can be accessed from Apex code that is part of the managed package." This confirms that protected visibility is tied to managed packages.

3. Apex Developer Guide, Accessing Custom Metadata Type Records: "If a custom metadata type is protected and in a managed package, it’s accessible only through the code in that managed package." This section clarifies the programmatic access rules that fulfill the question's requirement.