Hey Roy... very good (okay, GREAT) article.

I thing to emphasize... as long as you need that backup, you need to keep the security certificates. Think SOX. You may need that certificate for many years. And, of course, it can't be kept with the backup... sorta nullifies the security. How to manage the security of the certificates separately from the backups needs to be thought out in advance also.