We're going to be implementing encrypted backups in SQL 2014 soon and I'd like to know the gotchas or lessons encountered by anyone else who has done the same. I've read up at MSDN and elsewhere, created my master key and cert for backups in master db (and backed them up!). We do prod-to-test refreshes occasionally so I'll create the prod cert there from the backup file. None of our databases are TDE.
What do you recommend maintaining the cert & key backup files and keeping them secure? What kind of problems have you had long term with administering the backups or restoring them during DR?
Just looking for tips to avoid the arrows that inevitably come with something new & different. Paranoia level is high where recoverability is concerned.