BorgBackup can be made to operate in pull mode too, see: https://borgbackup.readthedocs.io/en/stable/deployment/pull-...

At work I've implemented a variant of the ssh-agent method described there. Admittedly, it requires some scripting :)