The new PASSWORD_STORE_SIGNING_KEY feature now supports this. See the other thread. I could also make this feature opt-in via an environment variable...