Looks like there is an encrypt module that uses AES-128: http://camlistore.org/pkg/blobserver/encrypt/. The modules are composable so you could encrypt your remote replicas of the main store (or hopefully all of them?)