You can have a self-controled intermediary machine that pulls backups, encrypts, and then pushes them to the untrusted cloud. When I had no resources for this

You can have a self-controled intermediary machine that pulls backups, encrypts, and then pushes them to the untrusted cloud. When I had no resources for this (eg: low income student), I had a server at my mom's place that did this for me. Low-cost offsite, trustable backup server for personal usage.