I understand a complete server reset would be inconvenient.

I’m quite fond of veracrypt: It offers good encryption and is transparent when mounted.

You can create and mount a container file with veracrypt, copy your existing data in there and replace the original folders with appropriate symlinks. I think thats the best tradeoff for good protection and convenience

Was actually confronted with the same problem - thank you for the solution!

Aegis authenticator. Beats all proprietary apps I’ve tried so far

I’ve been contributing to it via Street complete (can get it on fdroid) and it has become quite a hobby of mine.