[Youden]

The issue I have with that is that if everything is done by the backup server, it has the ability to both create and destroy (prune) datasets (snapshots), which means it has the ability to erase all of the data and all of the backups.

One thing I like about Sanoid/Syncoid is that if you set up Sanoid on both sides and use Syncoid to pull, the backup server only requires the ability to send snapshots (which you can configure with "zfs allow"). The backup server also doesn't require root in this case. This means neither server can delete the other's data.

And you still get all the automatic snapshot creation (done on the primary server) and pruning (done on both servers).