And if you use an untrusted sync like Google Drive, you can enable a keyfile and never let that file lane on Google Drive.