As aw3c2 points out, backups and export options can resolve two of the issues you cite.
As for "if your database gets stolen", that is covered by the encryption of the data and the login method: a password that you know (this one you would have to remember, obviously) and a key file (this may or may not (probably not) be counted as two-factor authentication, depending on how you manage the key file). The thief would not be able to open the database to find your credentials.
If the credentials store and the credentials required to access it are both compromised, so someone does have access to all the data stored within, then you have the problem of changing all those credentials before anyone malicious does something with them. With a backup of the database you have a convenient list of everything that needs to be changed so you don't forgot something important (though anyone else with access to the compromised data also has this list...).
While having a central key store creates its own problems if it itself is not secure, I think that little extra risk is small compared to the risk from other password management (using easy-to-remember things that are thus probably easy to guess, and/or even worse: using the same credentials for many uses). The risk of compromised password store is a local issue, so is something you can control (and hopefully mitigate) locally - no one can try brute force my keepass DB remotely unless they somehow get hold of a copy (which is possible I suppose, but not easy and would require them to be specifically looking for my credentials rather than a more general hacking attempt), but they could try brute force any of my many online accounts or just hack a poorly coded online application and read badly protected credentials.
Bad password managers (or good ones badly used) are a problem as you describe, but if used right a good credentials store with unique random long passwords for every service/account is (IMO) better than any other suggested solution I've come across.
Comments
As aw3c2 points out, backups and export options can resolve two of the issues you cite.
As for "if your database gets stolen", that is covered by the encryption of the data and the login method: a password that you know (this one you would have to remember, obviously) and a key file (this may or may not (probably not) be counted as two-factor authentication, depending on how you manage the key file). The thief would not be able to open the database to find your credentials.
If the credentials store and the credentials required to access it are both compromised, so someone does have access to all the data stored within, then you have the problem of changing all those credentials before anyone malicious does something with them. With a backup of the database you have a convenient list of everything that needs to be changed so you don't forgot something important (though anyone else with access to the compromised data also has this list...).
While having a central key store creates its own problems if it itself is not secure, I think that little extra risk is small compared to the risk from other password management (using easy-to-remember things that are thus probably easy to guess, and/or even worse: using the same credentials for many uses). The risk of compromised password store is a local issue, so is something you can control (and hopefully mitigate) locally - no one can try brute force my keepass DB remotely unless they somehow get hold of a copy (which is possible I suppose, but not easy and would require them to be specifically looking for my credentials rather than a more general hacking attempt), but they could try brute force any of my many online accounts or just hack a poorly coded online application and read badly protected credentials.
Bad password managers (or good ones badly used) are a problem as you describe, but if used right a good credentials store with unique random long passwords for every service/account is (IMO) better than any other suggested solution I've come across.