Linux – Duplicity Incremental Restores

You are describing log shipping, but you want to use 'differential' backups instead of log backups, which is the problem with your approach. With log shipping you restore the database once, then apply log backups as they are being created on the principal site, and you never ever have to redo the initial full backup restore. Just keep applying the log shipped over every few hours and you'll have your read-only copy available.

The default mode of duplicity is to use a symmetric key which consists of a simple passphrase. There's no way I would use that though: if you have to type the key, you can't run an unattended backup!

If you want to run an unattended backup, you have to pass duplicity a public key somehow. The only kind of public key that duplicity supports is GPG, and that requires a key pair. If you don't want more security than the passphrase provides, keep plenty of copies of the private key around (e.g. store it on every backup media, and print it).

Note that you need to choose a really good passphrase (as in long and having high entropy) to get reasonable security from offline attacks (which is the threat here).