Encrypting an offsite copy
Whatever stores the offsite copy should only ever see ciphertext. Public-key encryption keeps the private key off the backup host entirely; only the restore machine needs it.
Keep a printed copy of the key fingerprint next to the restore instructions. A backup that nobody can decrypt is a very expensive random file.