> We really, really want to make the append-only mode with restic work but the security implications of the restic serve model (and mount ? going from memory he

> We really, really want to make the append-only mode with restic work but the security implications of the restic serve model (and mount ? going from memory here ...) make us very uneasy. That's fair. The words "serve" and "mount" ring alarm bells, but I think it's misplaced in this case. rclone "serves" over stdio, so all communication occurs over stdio-over-SSH. rclone doesn't mount, but does have an internal VFS, which is entirely userspace and implemented in rclone's Go.