I thought there are a lot options for this already (perhaps even any descent back up tool?)

For example, restic with SFTP backend. I thought restic encrypts data client side before SSH transport. Am missing something?

Other tools: duplicacy, rclone, Borg (this might run on server), ... Duplicity does asymmetric and symmetric crypto, but no dedup. So if you change a file path, it “might “ be reencryptped.