I do something similar but using Borg (backup), gocryptfs (encryption) and rclone (sync) for cloud backup. No cascade.

Not OP but why would you want to use rclone crypt with restic if restic already does the encryption for you.

There are sometimes vulnerabilities in software. For instance, popular rclone and tarsnap have had fatal vulnerabilities in the past.

Also, I have a crypt set up for other stuff and rather deal with one remote.

Otherwise, cascades encryption is generally not recommended.

Do you have any links about the tarsnap vulnerability?

I've been using it for a few years and was not aware of it so would be great to know if any backups were affected.

https://www.daemonology.net/blog/2011-01-18-tarsnap-critical... (2011)

Thanks Colin!