Append only permissions.

Encrypted deltas.

Basically the time of the connection is the name of the only that folder that you have access to.

You can also setup a yubikey (or nitrokey) that requires you to physically process and would be immune to the host being compromised.