Thanks for the suggestions, I have and will implement some of them.
For simple file backups I just finished putting together a zero knowledge solution using restic with idrive e2 for storage. On the client PC there is only the restic executable, restic-browser (to restore files later with a UI but need to manually type in repo info), and logs. TRMM stores all repo info and sends the backup command according to the schedule. No access keys, repo encryption password, or repo address is stored on the client PC. Virtually no evidence exist of there even being a backup in place (aside from the log files).
After the backup process ends, a maintenance process starts that prunes older backup versions according to configurable settings. Maintenance also verifies data integrity in the repo.
My implementation has every PC getting an individual repo and encryption key, but I can easily have all PC under one customer backup to the same repo. This would make de-duplication more effective. A tagging feature is available to distinguish each PC's snapshots. However, the maintenance process on each PC might interfere with each other. The backup script can be given a random delay to combat the potential issue, but I have done no testing for that method.