[rdiff-backup-users] Incremental, automated, remote, secure

[Grant]

I'm struggling to devise an incremental, automated backup scheme that
remotely and securely backs up data from one system to another,
preserves permissions and ownership, and keeps the backups safe even
if the backed-up system is compromised.  Would the following work?

I have a local laptop, remote desktop, and remote server.  The laptop
and server could push to the desktop via rsync.  I think rsync would
need to write to the desktop as root in order to preserve permissions
and ownership.  I could use PermitRootLogin forced-commands-only and
restrict rsync to the backup directory in authorized_keys.  The
desktop could then run rdiff-backup from the rsync'ed files to a
repository in a separate directory.  The laptop could pull from the
same rsync'ed files on the desktop and run rdiff-backup for its own
repository.

I can't think of a scenario that could wipe out all of a system's
backups without both the laptop and desktop failing or being
compromised.  Am I thinking this through correctly?

If I back up a file from one system onto another system and then
restore that file and copy it back to the original system, will it
arrive with the original ownership if the file's original owner and
group do not exist on the system it was backed up to?

- Grant