Alternatively you could use a combination of AES and RSA similar how pghoard implements it: https://github.com/ohmu/pghoard
The RSA keys (or path to them) would be passed as environment variables. It would be a little easier to setup than gpg (especially for automatic backup restoration).