I see references to managed switching for that router. But my very limited and long ago experience with 800 series boxes is that they have a nasty habit of shipping minus the licence for that bit. I think your design will need that item, so make sure it s definitely included.

You may have a lot of isakmp debugging to work through on your IPSEC connection - the DSL should be no worries as long as the guy at the ASA end is ok with setting up a dynamic VPN for you, but on your backup to the backup to the backup connection, a problem with unpredictable routing might occur which would cause the router to drop stage 1 VPN connection packets. If you make sure you buy a good smartnet with TAC support your life will become a lot easier.