Honesty first: backup is a procedure you run, not a goca feature yet. There is no backup API, scheduler or verifier today — pg_dump or a volume snapshot on your own schedule, driven by whatever already runs your backups. The designed backup service is on the roadmap; until it lands, this frame is the feature.
A recoverable set is three things, useless without each other. The database — every CA key in it is wrapped, inert without the master secret, though the dump still holds every subject you certified: sensitive data, just not key material. The escrowed master secret — the half that cannot be regenerated; without it every backup you own is a certificate inventory you can no longer act on. Escrow it separately from the dumps: one stolen secret plus one database backup is every software-custody CA you run. And the recipient key files — without them, stored secrets must be re-entered by hand: recoverable, but manual.
Cadence: nightly, plus an event-driven backup after any ceremony, rollover, custody change or root operation — exactly the moments a nightly schedule exists to miss.
Now I can name the three things my backup must contain, and where each lives.