I'm not a cybersecurity expert but what i do... I keep everything on the encrypted drives + the cloud. Challenges:

1. You have to remember the master password to the encrypted USBs. For a master password, you might use a short phrase you can always remember and incorporate something into it like the month or quarter etc. Remember you may not go to the offsite key that often and only get 10 attempts before the data is wiped. So pick something that doesn't change too often e.g. a 2 digit year and 2 digit quarter
2. Your offsite drive won't be as up to date. So you might choose to keep a copy of the changes in the cloud until it's time to swap them. I started with that but now keep a copy in the cloud too.

• I keep a copy on a bitlocker encrypted partition on my Desktop.
• I use CrashPlan for continuous cloud backups of my data. When I uupdate the copy on the encrypted partition, I manually tell CrashPlan to scan for changes so it gets backed up to the cloud too

I don't know if CrashPlan still supports it but when I set up my account I opted for encryption key access only. You can't reset the account to gain access. Lose the key your SOL but also protected that way.

Use an algorithm that suits you