Tl;dr, back up your whole wallet descriptor sans private keys. They're a little less sensitive than private keys as they can't spend funds (but can give up privacy), so most find it safe enough to encrypt them and store them digitally (which should NEVER be done with private keys that guard anything important).

I haven't played enough with Taproot yet to know if it makes this slightly less onerous especially if you've got your keypath key or musig2 keys, but am curious. Mostly waiting to not need to use edge firmware to roll it out on the coldcard.