Backups encrypted with a key nobody could find

An encrypted backup is a backup you cannot restore unless the key is somewhere the restore procedure can reach.

the questions, asked during a drill:

  where is the key?          a password manager
  who has access?            two people, one of whom
                             left in 2022
  is it in the runbook?      the runbook says "the
                             backup key"
  what if the password
  manager is unavailable?    unanswered

the fix: the key in a second location, sealed, with the
runbook naming both and the drill using the second one.

Encryption at rest is right and it introduces a dependency between the backup and the key that the backup strategy has to cover explicitly. Testing the restore with the primary key proves the backup works and proves nothing about the recovery scenario where the primary store is what is unavailable — so the drill alternates.