If you're doing pull to prevent remotes from destroying old backups (in case of malware takeover, etc), this can be solved by running rest-server with --append-only

https://github.com/restic/rest-server

It 403's any attempt to overwrite or delete old data.