The remote machine has a zvol exported over iSCSI (over Wireguard). The NAS mounts it and uses GELI and then creates a new ZFS pool there. I use zrepl to mirror snaoshots from the local pool to the remote and also on the remote side to snapshot the ZVOL.

If the NAS is compromised or starts writing nonsense, I can roll back the ZVOL to an earlier version. If the remote machine is compromised, it can delete the backups, but can't see their contents.

The only things from outside the base system are the wireguard tools and zrepl.