"backup readiness" ends up meaning you need a migration path for old ciphertext, not just a new algorithm for fresh backups. If the archive format bakes in today’s KEM and signatures, the annoying part is all the cold data you can’t re-encrypt in place, so restore tooling has to be able to decrypt with legacy keys for years without making that path the new soft spot.

What gets glossed over a bit is that old backups are often only useful if you can still verify their authenticity with the original signature scheme, so a PQC cutover is not just a ciphertext rewrite. If the archive format or catalog keeps only today’s signer, you end up needing to preserve an old verification path for years just to restore one clean point in time. That makes cold, air-gapped sets awkward, because the migration itself usually means mounting and decrypting the very data you were trying not to expose again.