>My preferred solution is to let client only write new backups, never delete. The deletion is handled separately (manually or cron on the target).

I do this by making backups visible to users on a `/.snapshots` directory that is the same as the target of the backup script, but mounted NFS read-only.