First of all, brute forcing the password is not needed unless the user fails to log in. The system is designed for the user to send the most important secret,

First of all, brute forcing the password is not needed unless the user fails to log in. The system is designed for the user to send the most important secret, on which the rest of the system's security depends, to a third party. That being said, brute forcing a password is not the same thing as brute forcing a secret key. The distribution of passwords that people can remember is not even remotely uniform, and the distribution of passwords that people actually use is even more heavily biased. Compare to GnuPG: the attacker needs access to your computer before he can even attempt to brute force your password or try to capture it.