The reason I am asking this is the following:
My boss wants me to sell a backup solution where encrypted backups are to be stored at our site. But we shouldn't have the key to decrypt them (in case we are hacked). The backups should also only be tested on the client's side, not on ours. Because according to him, this wouldn't be necessary.
So here is one scenario where I think that kind of assumption would be problematic.
Let's say the ransomware is able to fully control the backup software. It will show all tests as ok, but secretly it encrypts all backups with two public keys. One key pair is generated on the machine itself (the private key will later be securely erased). When the user tries to restore a backup, the ransomware will actually decrypt it correctly. It will also create modified rescue media. At a certain date, the ransomware will erase the private key and decrypt all live data on the network.