Is there an implementation of a file-sharing network protocol where the server has no idea what data is being stored, but can serve the encrypted files to clients that will decrypt them on-the-fly (if the client knows the key)?
Yes: Windows EFS at least, can be used that way.
Each file is encrypted with a unique, random key and that key is the encrypted once for each user who has access to the file and the result is stored in the NTFS alternate data stream of the file
So, as long as the NAS supports NTFS, you can use EFS on it and the actual file storage server will never see the cleartext content of the encrypted files.
For people in the future reading this, I ended up with the following solution:
A NAS with a non-encrypted drive through SMB/AFP. On this drive I created a disc image with encryption. The clients connect to the SMB/AFP drive, locate the disk image and mount it using the encryption key. This effectively achieved what I needed, although in a slightly clumsy manner.