To improve security of option 1 you could use a keyfile, that is either only transferred manually to devices or stored at a second cloud provider.