I'd be interested in seeing some profiling for key decrypting, it might be pretty quick and we're over-engineering this. However, that being said, I'd be fine with changing the decrypt to be more like a private method that is only called when we know what to use and the password is provided via unlock.

The multiple password question is a good one..