Encryption should happen client-side [1], an S3-to-S3 gateway wouldn't help unless you deploy one on all client nodes.
s3cmd and duplicity has support via GPG, but not all S3 clients will know what to do with those files.
Our server software is typically deployed as close to the source data as possible. This lets us move only deduplicated data over the WAN. It also supports our encryption model where we encrypt using a pluggable key management service e.g. Amazon KMS or a on-premise HSM before any data leaves the customer site. This is essentially the same model as traditional tape and disk backup software within the datacentre.
Additionally we use HTTPS between clients and our server, and our server and the storage provider (e.g. S3), as well as being able to enable server-side encryption for S3.
[1] http://www.skylable.com/blog/2014/09/transparency-reports-se...
Disclaimer: I'm co-founder of Skylable