Alright, was curious as this is how I have been handling my third layer of backups for quite a while now, regular incremental encrypted zfs snapshots to an offsite storage provider using API keys that only have write priveleges. Wanted to make sure it wasn't something about "snapshots" which made this a bad idea in a way I hadn't thought of. Doesn't seem that's the case.