And on top of it I'll add that Syncthing added a feature called "untrusted device encryption"

https://docs.syncthing.net/specs/untrusted.html

So you can set a node in the cloud and set an encryption key between two endpoints, and whichever nodes that have the directory synced but doesn't have the encryption key will never have access to the decrypted data.