Presumably any attacker only cares about the encrypted data, not the user's credentials. The data is encrypted with a single data-key - so the attack would focu

Presumably any attacker only cares about the encrypted data, not the user's credentials. The data is encrypted with a single data-key - so the attack would focus on cracking that key. The attacker knows that identical processes are used to encrypt that data-key. Even with multiple keys and nested encryptions, it seems that at the very least that the reduced entropy of search space around the data-key can be used to optimize a brute-force search. This would be further compounded if at least one user's key-encryption-key were known. I'm probably missing something important, but if I've learned anything from the cryptopals challenges its that you don't want to reduce your entropy in any way. Would a simple solution be to add a random salt at each level of the nested key encryptions?