@arclight It does cross my mind that one reason to have an off-site backup -- or just air-gapped? -- is that a broken process can't reach it.