Encrypted disaster-recovery backups
Backups are now full, self-contained copies of a disk shipped off the cluster to independent object storage, so they survive losing the cluster, not just a bad change. Every backup is disaster recovery by design: you pick the destination backend (Wasabi in Germany, ImpossibleCloud in France, or local ServersCamp S3), the archive is compressed with zstd and encrypted before it ever leaves the host with your organization's key (age, ChaCha20-Poly1305), and you can view that key in the cabinet to decrypt archives yourself. Two SHA-256 fingerprints are recorded per backup (the raw disk and the stored archive); the raw hash is re-verified on restore before anything is written, so a corrupt restore is refused rather than booted.