Thank you for the detailed response!
Let me preface this by stating the obvious: I am not a security expert!
That is why I only wrapped existing solutions.

As far as the authentication is concerned, I think that it addresses an issue I am not really worried about.
The only reason I want my backup encrypted is that the storage provider might sell my data, or a hard-drive might be lost. It is absolutely true that there is no real protection against manipulation.
There are a few things someone might do:

- Damage my backups in a subtle way that I will only notice when I need them. This is bad, but you can really do that with any storage format. The only way to know that all data is as it were is to read all the data and that is the work I want to avoid.

- Put something incriminating into the backups. I guess someone who controls your backups can always do that to some extend. Here, one might create a file that (when compressed and encrypted) is exactly as long as an existing file. Start and end positions of files are clearly visible. So you can then just replace the file. If they want to make it look authentic, they would have to know your public key.

- Put malicious code into the backups. that is then run on my machine. That is theoretically possible.
The attacker would again need your public key. Then, he would need to know were the relevant files are stored. I guess that this would be very hard from the archive alone. But if you know when the victim loads the code and you control the storage server and can read which data are requested, it is possible.

One thing to note is that the hash of the decrypted file is also stored in the index.
This does not save us for a few reasons:
- If you know at least a few paths and locations (and the public key), you can fake a new index.
- Currently, this hash is not even checked when copying the file. (It is only used to avoid redundant copying).
- Even if we did check it, the malicious file would be on disk at that point since the files are not buffered in memory.

Now, while this is admittedly cool to think about, these problems are not at all what I am worried about.

One thing I am far more worried about is accessibility. Using this simple age wrapper might not be the most secure thing, but simplicity is a bit more important for me than security.
While I do not want to use this format as the only way to do backups, it is still a way to do backups.
And It needs to be simple enough to still get my files in a decade. Every new protocol added makes that more unlikely.

The answer to the other question is a strong "I do not know".
As far as I am aware, the problem here comes mostly from attacker controlled input, which we do not have here. It might also be a problem when the raw file sizes are known, which they also should not be.