[yjftsjthsd-h]

I think syncthing wins here. Not at rest, mind, but since you control the endpoints that should be okay.

[microtonal]

Even though it's proprietary, Resilio Sync does encrypted peer to peer sync, plus it allow encryption-only nodes. These contribute bandwidth, but cannot decrypt the data.