Interesting inconsistency re sec=sys, as my /proc/mounts has nfs4 sec=sys, and /proc/mounts is supposed to only show active options, unlike /etc/mtab, I was going to say, however these days it seems /etc/mtab → …/proc/self/mounts.
idmapd is supposed to work but need to poke /sys/module/nfs/parameters IIRC, possibly on both ends. Doco implies idmapd is NFSv4 only. One of these things I’m still waiting for a round tuit.
Now, you can create a file and put it into /usr/bin, give it +x attribute and you are done, backup and restore with one command, and no passwords will be asked.
Assuming that no password is associated with the key, or it is already loaded into your agent.
Or you could generate a special nas sync key without a password, which you then are able to to lock down to specific tasks / configuration in the remote sshd_config or remote .ssh/authorized_keys.
You can also bind specific keys to a host by configuring the host in .ssh/config, so you only have to do it once and it applies every time you use ssh to that host any way.