Now to do generate the backup keypairs securely would require the ability to generate keypairs offline (preferably on an airgapped system), but as I mentioned above I haven't been able to figure out how to do this - in particular, I haven't yet figured out how to generate a public key from a private key in a place that's sufficiently distant from the internet.