I can confirm that our RPi2 still has the hardware RNG, so we're good to go!

Thanks a lot, I will check if our PI's have a hardware RNG. I'm aware that key management is a problem. We plan to generate RSA key pairs and copy the private keys to a USB-stick that will be stored in a safe place (actually 2 USB-sticks stored in 2 safe places). The public keys will be used for backup encryption so the private keys will only be used when we need to decrypt a backup. Decryption will take place on a secure (air-gapped) computer so I believe that our private key will stay very private.