* You don't have to rotate what doesn't get out.  Limit ingress to relevant IPs reduces this surface area a lot.
  * SCP to a system built for storage.  Not really essential for many systems - system logs are fine.
  * Every VPS provider comes with a backup check box.
  * Tailscale is really simple.