I'd also recommend
rsync for the transfers. Since it runs over SSH it can be set to use keys for authentication. That also allows the exact
rsync parameters to be locked down as part of the key itself.
Steps:
- test manual rsync transfer
- test manual SSH connection with keys
- test manual rsync transfer with keys
- lock down public key with command="..."
- add to cron job or incron job