> In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS

> In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern This is the key point. Properly implemented, you should feel very relaxed if your encrypted data is leaked. I'm using BitWarden, but 1Password's "secret key" concept is smart, it means your data is still very secure even if your password sucks.