You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.
Also, hi from downstairs!
2) If you get physical access to the device, you can pull the DB and whatever IDs are involved. Without encryption, this is game over instantly; with encryption, your goal is to delay it as long as humanly possible.
key = hash(hardware serial number, user password)
And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?