Maybe you can put the whole .pass directory inside an encfs directory.

Encryption all the way down.