I've been interested into rsync.net. How does it work if I want my remote ZFS dataset to be encrypted without leaving the key on the remote server?
If you have multiple terabytes of data, zfs-send is a very efficient (and elegant) way to transfer them to rsync.net.
We can give you your own zpool, with root, running the latest production/stable ZoL code - so you will have encryption and raw send, etc.
However ...
If you have hundreds of GB up to ... one or two TB ... we paste this suggestion to you instead:
I think you should look into the 'borg' backup tool - it has become the de facto standard for remote backups because it does everything that rsync does (efficient, changes only backups) but also produces strongly encrypted remote backup sets that only you have a key to ... rsync.net has no access to the data.
The borg website is here:
https://borgbackup.readthedocs.io/en/stable/
and a good description of how it works and why you should use it is here:
https://www.stavros.io/posts/holy-grail-backups/
... and our own page with details of our attic/borg support, along with a deeply discounted signup link, is here:
"The last addition is the ability to do raw, encrypted sends and receives. The idea here is to send raw encrypted and compressed data and receive it exactly as is on a backup system. This means that the dataset on the receiving system is protected using the same user key that is in use on the sending side. By doing so, datasets can be efficiently backed up to an untrusted system without fear of data being compromised."
Unfortunately it's taking a long time for the feature to propagate through the ZFS implementations. I don't know if rsync.net's servers support it.