Move your first copy offsite this weekend, here's the exact path

Move your first copy offsite this weekend, here's the exact path
Local backups die with the building, the fire, the seizure, the bankrupt host. Playbook:
— Pick a provider in a different country than prod
— Encrypt client-side before upload, the provider never sees plaintext
— Store the encryption key somewhere that isn't the backup itself
— Set lifecycle rules: hot for 30 days, cold archive after
— Do one full restore FROM offsite, over real internet, and time it
Offsite you've never restored from is just expensive cloud storage. Fight me in the comments.