We give you an empty filesystem to do what you want with.

So you can indeed encrypt your data "at rest" and you would indeed control your own keys. We recommend the 'duplicity' tool which works very well for encrypted offsite backups at rsync.net:

http://duplicity.nongnu.org/

http://www.rsync.net/resources/howto/duplicity.html