Nice summary of the crypto bits, I’d only remark on the backup suggestion though: just use borgbackup with whatever storage provider fits for you