Maybe there could be a way to negotiate a secure channel between a browser and password manager. Say, when setting up, a browser gives you a key to retype into password manager, and then it's used to encrypt the password before putting it in the clipboard.

Adds one more step for setting things up but saves the clipboard as a whole. People using password managers are already people willing to jump through some hoops to set things up, adding one more hoop shouldn't make things worse.

Have the password management app emulate a custom keyboard?

Probably doesn't work anymore, as conradev notes[0], applications used to have clipboard access when running from the background (so after TTL expires 1password could go in, check if clipboard data was still the password and remove it even if not active) but that's not the case in ios9, only the currently active application can access the clipboard. So unless apple added TTL to clipboard items (which UIPasteboard's documentation doesn't indicate) it won't work anymore.

[0] https://news.ycombinator.com/item?id=10411166