I guess it depends on your security model. With one single pull backup, - if your backup box is on another network then it can be coerced into malicious reads

I guess it depends on your security model. With one single pull backup, - if your backup box is on another network then it can be coerced into malicious reads (leaking private information, trade secrets, your competitive advantage etc). - if it's on the same network then it's subject to your same failure patterns. Push backup has some disadvantages, but there's a lot of peace-of-mind in never (intentionally) granting additional users access to the unencrypted data. Two-tier is one approach. There's another comment in this thread about snapshotting filesystems (ZFS, or i suppose LVM snapshots might be easier) which would be another method of addressing concerns about the client tampering with the backed up data.