Thank you so much for this very comprehensive reply regarding certificate protection.

The idea of creating a dedicate backup user is superb and something I hadn't considered.

That along with severely restricting permissions is a path well worth taking and something as I progress this, will build into the overall process.

In essence, although I remain sceptical about all security issues, both are Debian computers, which remain (in my view) really solid machines that I don't have any major concerns about.

Thanks again for taking the time to reply. It's most appreciated.