[Box Backup] Certificateofobia?

[Magnus Homann]

Or I'm just not used to it. I read a couple of HOWTOS about 
certificates, but still...

1) Can I have the CA on the client machine?
2) Can I have the CA offline on floppy or USB dongle (or paper in my 
secret vault...)?
3) Is the data in cleartext after it leaves the client machine?
4) Can a nasty root user on the backup server (but not CA or client 
machines) read my backups?

I believe the answers are: yes, yes, no and no. But I could be wrong. :-)

Help a newbie, please?