Restic's threat model assumes trusted systems - the ability to make a backup also implies the ability to destroy and tamper with existing ones. Tarsnap has fin

Restic's threat model assumes trusted systems - the ability to make a backup also implies the ability to destroy and tamper with existing ones. Tarsnap has fine-grained access controls which can severely restrict hosts: https://www.tarsnap.com/man-tarsnap-keymgmt.1.html https://www.tarsnap.com/man-tarsnap-keymgmt.1.html e.g. you may give each host their own write-only key so they can automatically create new snapshots, while keeping the keys that permit reading and deleting old snapshots on separate machines with separate passphrases.