Mac – getting “Time Machine is backing up an encrypted disk to an unencrypted disk” when I’m not using encryption

To answer your first question about the keychain and whether you should encrypt backups: the passwords in your keychain are already encrypted, that's why you always have to type a password (by default your login password) to show stored passwords. So there's no immediate need to encrypt.

Of course, you could add Time Machine encryption to provide a further layer of security. This is possible starting with OS X Lion and Mountain Lion (from http://support.apple.com/kb/ht1427):

OS X Lion and Mountain Lion let you encrypt the Time Machine backup external drive using FileVault 2.

FileVault2 also uses your login password, though. So if the bad guys are able to guess or crack that password, they will have also access to your keychain information. Choosing different passwords for login and for accessing your keychain would protect the keychain passwords in such an event.

Either way, use strong passwords, password quality is of foremost importance to protect your data.

EDIT:

The OP asked in a comment how to set different passwords for login and keychain. Here is how:

• Open Utilities>Keychain Access.

• Right click each keychain and select 'Change Password for Keychain XYZ':

  

If you prefer to use your current password as keychain password and change your login password, log in using another account and change your account's password from System Preferences>Users & Groups. That will only change your login password, not your keychain password.

If you encrypt something once, you can't weaken it by encrypting it another time. You can strengthen it, but not very much that it makes a big difference. Most attacks are brute force password Crack attacks, on both filevault and the disk image, because there is the highest chance for the decrypter to win. So you harden the step of decryption because you encrypt twice, but you don't harden it much. but btw, best anti brute force tactics are using algorithms like PBKDEF2 instead of simple SHA. but that's something only apple can do. and I expect from them to do something like that.