Sounds like a typical tarsnap set up. You can have a key that only appends backups, but can't delete them.