Version control system with local overwrite protection?

[lk]

Users shall be able to flag files in their working copies as
immutable, i.e., these files shall not be overwritten when
synchronizing the working copy with a repository (what usually is
called an "update"). This is primarily useful when using the VCS
as an archival system and users wish to make 100% sure that
existing files will not get lost, even if the server with the
repository is compromised.

I asked for this on the Subversion mailing list some time ago,
and there were some definitive negative answers. So it has to be
something different than Subversion. N.B.: I am not looking for a
way to protect a repository from unwanted commits or such, but I
want that users can protect their working copies.

Of course, distributed systems, e.g., Git, carry such a feature
intrinsically. However, their combinations of working copy and
repository require more disk space, often factor 2, than a
working copy alone. (BTW, one has a similar negative effect with
Subversion's prestine copies inside the working copy; however
this can be circumvented by using the Fsvs client.)

Any suggestions?

Thank you!