I see. Two factor: something you have: local storage key; something you know: your email account password.

Lose your device and use only password manager in device and you’d still be out of luck.

That said, do you think the threat risk of trusting Apple with the encryption key for end to end encrypting data with Sign in By Apple is much different than the approach you are implementing? In both cases, at least you wouldn’t have access to the user’s data and you have to trust Apple to some extent given they are in charge of securing local storage and device security.