If it uses pbkdf2 with sufficient rounds and a decent password (say 5 words from diceware) it should be perfectly safe to upload the keys. Better to keep them

If it uses pbkdf2 with sufficient rounds and a decent password (say 5 words from diceware) it should be perfectly safe to upload the keys. Better to keep them offline and keep ownership of the key as a second factor certainly, but encrypted keys can be a fully acceptable single factor.