I use `pass`, which is basically gpg+git+xsel. My user account could be compromised, but it won't be through my password manager.