Pretty boat.

If you’re using LUKS don’t forget you can dump/backup the header. It isn’t the encryption key but is critical if you accidentally do a stupid. As to the keys themselves, how about convert them to qr codes, print them, and store them in a safe.

I just updated from 2.3.1 and it seems fine. At least it didn’t automatically nuke everything.