About time
I remember having this discussion with the EMC bod over in Cork when they first demonstrated time-ordered asynchronous replication. It was always possible to have remote DR without dataloss at the not inconsiderable costs of having yet another full-sized copy at a building outside the charmingly termed "blast radius" but close enough so that latency was acceptable, synchronously replicating to that and then async to the remote site. Of course if you want this setup to by symmetrical (as you might want with mutual DR) then the remote site also has to have a staging location.
It seemed to me blindingly obvious at the time that what was requires was a black-box that effectively secured all the writes at the staging location, and then passed them on asynchronously to the true DR site and that would only have to be large enough to hold all the write activity that might be expected for the period of time taken to do a true remote replication. Of course you also need to allow enough space to buffer writes to cover outages on the async long distance link (but such activity could be staged to disk store so costs shouldn't be impossibly high). If you don't have such a buffer, then in the event of the loss of the async link, you will trash the integrity of your remote copy and have to resync it adaptively.
You also need the option to mirror the replication, including the staging device, by two paths plus the necessary logic to avoid double-applying at the remote end.