Put something in a box. It holds until the lease runs out, and you can renew it.
The link — say it or write it down
PIN — send this a different way
Owner key — keep this; it renews and destroys the box, it does not open it
Leased until
The server can open this box. Contents are encrypted on disk, so a
stolen backup is not a stolen box — but whoever runs the service can read what is
inside. If you need otherwise, that is burnbag, and the link gets long.