Comment by valenterry

Right. That's why I think that the client syncing (all) credentials is just what I don't want/like and there must be a server, since a compromised client can obviously not be trusted to doing any rate-limiting.

And the server also needs to inform about usages, since otherwise a compromised client could just extract everything slowly over time.

Does that make sense?

Otherwise, basically just one compromised client means that suddenly all my credentials need to be considered stolen and have to be changed everywhere.