My carefully updated list of files to backup had grown so long that it made me worry about losing something important and the backup didn't fit on a single dvd so I invested in a WD passport and created an encrypted file system on it: 

 modprobe cryptoloop
 modprobe aes
 losetup -e aes /dev/loop0 /dev/sdb
 mke2fs /dev/loop0
 tune2fs -i 0 -c 0 -j /dev/loop0

Then taking a backup is an rsync and some setup-up/tear-down code away: 

 #!/bin/sh
 set -e -x
 
 NAME=`hostname`
 
 modprobe cryptoloop
 modprobe aes
 
 cleanup () {
     umount /mnt/root-snapshot
     lvremove -f /dev/vg/snap
     umount /mnt/backup
     losetup -d /dev/loop0
 }
 
 cleanup || true
 
 losetup -e aes /dev/loop0 /dev/sdb
 mkdir -p /mnt/backup
 mount /dev/loop0 /mnt/backup
 
 lvcreate --size 2g --snapshot --name snap /dev/vg/root
 mkdir -p /mnt/root-snapshot
 mount /dev/vg/snap /mnt/root-snapshot -oro
 
 mkdir -p /mnt/backup/${name}
 # note the lack of trailing slash after /boot
 rsync -v -a --delete --one-file-system --sparse /mnt/root-snapshot/ /boot /mnt/backup/${NAME}/
 
 cleanup

Note, that it's this easy since I basically have only one file system (only /boot is separate) and that resides on LVM which makes it trivial to snapshot.