[skybrian]

This can be done by encrypting each backed-up item and forgetting the key for deleted items that shouldn't be restorable from backup. You still need to decide how long the keys should be kept, though.