I think this depends on your appetite for risk. Forgive the trivialisation, however if you a). generate a strong symmetric key on the client b). encrypt keys

I think this depends on your appetite for risk. Forgive the trivialisation, however if you a). generate a strong symmetric key on the client b). encrypt keys on the client using AES and the strong symmetric key, and c). encrypt the AES symmetric key using the user's password, and d). store that encrypted AES key and the encrypted used keys on a zero-knowledge server, keyed on a hash of the user name, you might be able to log in from another device, using your user name and password. Both encrypted keys are pulled from the server based on the user name, and decrypted by inverting steps a to d.