Encrypting your backups without backing up the key is just deleting them slowly.

Encrypting your backups without backing up the key is just deleting them slowly.
Security-minded folks encrypt everything, feel responsible, and store the only key on the same server that's about to die. Lose that box, lose the passphrase, lose the keyfile in a botched migration — and your perfectly encrypted backups are now indistinguishable from random noise. You did the attacker's job for them. The key is a separate asset that needs its own offsite, redundant backup, ideally in a password manager AND a printed sealed copy. An unrecoverable key turns your safety net into a shredder. Fight me in the comments.