Hrm... well, would it be possible to just make a block device with `dd` and make it a loop-aes encrypted device before sending it to the offsite mirror? Or, perhaps mount a remote block device on the mirroring server and use that?