Restic and BorgBackup really seem to be the favored solutions out there. Restic for encryption, Borg for deduplication and compression. Or maybe bacula if you want pull based backups instead of push based.
At work I've implemented a variant of the ssh-agent method described there. Admittedly, it requires some scripting :)