I do not trust any kind of encryption inside devices, because I cannot verify how the keys are managed. The essence of encryption is that the key must not be stored together with the encrypted data, but if a key is ever used inside a device you cannot be sure that it can no longer be retrieved from it in the future.

The data files that I am writing to the tapes have their metadata written into a database to be able to retrieve them in the future, then I group them in chunks of an approximately fixed size (50 GB in my case), then I compress them, then I encrypt them and then I add some redundancy (with par2) for error recovery. A simple solution for compression with encryption is the lrzip program, but for more flexibility in encryption you could use e.g. the openssl program invoked with the desired parameters. There are many encryption programs and any of them is better than using the encryption option of a tape drive.

So I queue the files to be written on the tape in a directory and when the size of the directory exceeds a threshold (50 GB in my case) a script is invoked that does the processing mentioned above, including the encryption, then it writes the result on the tape. A similar script does the inverse operations when I retrieve a file or group of files from the tape, giving its position as a tape number + a tape file number as obtained from the file database.