Can you elaborate on the threat model a little bit? I'm struggling to understand how you can protect against this in a way where an attacker that both knows the relevant encryption key (whether public or secret, depending on whether the crypto is asymmetric) and has write access to the backup location.

If you sign the backups with some distinct key of the backup server, why wouldn't the attacker have access to those keys too (in the above scenario they already have access to the keys that the backup server is using for encryption).

I know there's an open issue in age for adding authentication[1], so there clearly is some threat this would protect against but I can't figure it out.

[1]: https://github.com/FiloSottile/age/issues/59