May I ask why you went from a wrapper around restic to rclone and not to restic? My understanding is that rclone doesn't make snapshots, does it?

I use restic (with rclone), which encrypts and handles snapshots automatically. It doesn't work with a pgp key, though, I use a password.