I lean towards over the top. What I mean is for backups out of my control, such as third party online, I only backup copies of my self made encrypted backups. This way, if the third party does get hacked, and someone figures out a way to break their encryption, they would have to then break my encryption. The idea is not to be the low hanging fruit.
Just as important, after completing your first backup with a new system (and periodically going forward), try restoring the backup. This will show you any missing items, or missing instructions you need to have. There is no point spending time on a backup if you are not certain you can restore from it...