Remember what you're protecting here: the keys to your data, not the data itself. You're at risk from the US government, but it's unclear that a government tha

Remember what you're protecting here: the keys to your data, not the data itself. You're at risk from the US government, but it's unclear that a government that can compel Dropbox to hand over your database and then crack some pretty heavy encryption can't access the accounts you're protecting with those passwords in some other way. The main adversaries, IMO, you're protecting against are non-government actors, and your setup should be completely adequate for those. FWIW, I have the same setup, but with Keepass.