Take a look at Authy as a drop-in replacement for your Google Authenticator app. Codes are encrypted and stored on Authy's servers -- they can be re-synced to your phone after a wipe. There's also a Chrome plugin that syncs with the mobile app.
How do we know it's encrypted in a way they can't see?
The same way you know (or don't) that your existing OTP app is not uploading your secret key.
You don't, but that's fine for my risk profile. I use LastPass, as well, with different passwords for every site and 2FA where available.