Yeah, that's the same crossroads I'm at. Currently using Proton Pass, and I like it, but it's inherently closed. Security by obscurity is kind of their m.o.
Yep, this is the way. A PR should have a single focus. So your updates may end up being multiple PRs.
awesome job capturing a moving target