Keep the backup key away from the backup

Backups were encrypted with age before upload, and the key sat at /root/.age/key.txt — on the machine being backed up.

Lose the machine, or have it compromised, and the attacker holds both key and ciphertext.

Keep the public key on the server, used only to encrypt; keep the private key locally or in a password manager, so the server cannot decrypt. Bring the private key only when restoring, and remove it afterwards. Keep at least two copies in different places — one copy ties your recovery to a single point.

age-keygen -o key.txt          # private key stays local
age -r <public-key> -o backup.age backup.tar.gz

And test it: decrypt once for real, to prove the key is right and the archive is intact.