I do the same, but then you should have two copies, encrypted-at-rest and one offsite.