Allow backup of VMs without backup of Encryption Keys.
There are some VMs where ensuring the security of the VM is more important than ensuring the longevity of that VM. Please allow backup of BEK encrypted VMs without also backing up the encryption keys or the BEK volume.
Auditing of the usage and permission changes of KeyVault needs to show the whole story. If a restore of a VM is required we can restore it as disks only and manually recreate the VM with the link to keyvault.
If the keys are deleted from KeyVault that should make all the backups unusable.