Backing up OKM (Onboard Key Manager)

Hi all!

one quick question, it appears to be a good practice to backup the Onboard Key Manager (OKM). The question that pops in my mind: if the keys aren't exportable, what is included in the OKM backup then? Also, I understand the OKM is replicated among the nodes of a cluster... how is this possible since the keys aren't supposed to leave the OKM? 

Thanks, as usual. 🙂 👍