It reads to me like encryption is handled one layer below this by NFS. I would naively assume this should be set up with external changes disallowed since it is capturing and replaying fs events.

I would love to see a replacement for syncthing though. Something with less config knobs, that 'just works' and handles conflicts more intelligently.