The cloud holds your backups and can't read the filenames

Your backups need to live off-site. They don't need to be readable off-site.

Mount the S3 bucket as a backend, then mount a crypt backend over it: POST /api/v1/backends/crypt, pointed at the S3 remote. From now on, files written through the crypt layer are AES-encrypted before they leave the container: content and filenames both. The provider's console shows ciphertext blobs with scrambled names. Reading back through the same URL decrypts transparently; your scripts never notice the layer exists.

No client-side encryption tooling, no key juggling in every backup script. One overlay, declared once.

The provider stores the bytes; the container holds the meaning.