> We really, really want to make the append-only mode with restic work but the security implications of the restic serve model (and mount ? going from memory here ...) make us very uneasy.
That's fair. The words "serve" and "mount" ring alarm bells, but I think it's misplaced in this case.
rclone "serves" over stdio, so all communication occurs over stdio-over-SSH.
rclone doesn't mount, but does have an internal VFS, which is entirely userspace and implemented in rclone's Go.