With a little setup (no more than described here), rclone just... does this out of the box.
Specifically I have an S3 remote configured to use the Deep Archive tier. On top of that I have an encryption remote (pointing to the S3 remote). Then I just rclone my pool to this remote, and all my crap is shipped off to Ireland.
Like in the link, I expect never to need it; restore is so expensive that it's a "house burns down" insurance only.