Absolutely, C is the weak link. There are ways to mitigate that, though. Like I said, there’s no need for a server. The intermediary can and should be all local.

As for cloud backups, there’s no reason to keep a log of requests, so there shouldn’t be anything to back up, other than the certs themselves. Even if there is though, that’s in the user’s sphere of influence. De-googling is becoming more and more popular, and there’s nothing preventing you from disabling cloud backups.

All this is just to take it back to my original point: The idea has some great benefits, but the implementation matters immensely