Adding a hardware key, like Nitrokey, would be an additional level of safety there. I would not use the database without some kind of additional key (something you know and something you physically have).

If there's something nefarious that has user access, you've already lost in that regard.