[Borgbackup] borg check and related bandwidth usage

[John Miner]

Which commands / situations can result in significant egress usage/bandwidth from a remote repo over ssh to a client other than when intentionally mounting to recover files?

For example, when "borg check" is used, the docs say that the repo is checked on the server/target if using ssh ("If you use a remote repo server via ssh:, the repo check is executed on the repo server without causing significant network traffic."). However, for an archive check, the docs say "If you use a remote repo server via ssh:, the archive check is executed on the client machine (because if encryption is enabled, the checks will require decryption and this is always done client-side, because key access will be required)." Does this mean the borg client will download the ENTIRE archive from the server over SSH to complete a check, resulting in significant bandwidth / egress usage if the archive is large? What if the remote repo/server is NOT encrypted, will it still download the entire archive to run a check?

Also, if I delete my local cache on the client, does the entire repo have to be downloaded from the server over ssh in order for that client to rebuild the cache or is it rebuilt on the server side and sent to the client?

I plan on using multi-terabyte archives and a remote backup host, so want to know which commands will cost me say $20 in egress fees every time I run them, not to mention a significant amount of time and potentially blowing my ISP bandwidth cap unintentionally. Maybe the answer is to do a local borg repo and rsync it to a remote host that can do checksums on both ends instead to avoid bandwidth issues with borg?