The Short Answer
Storing encrypted keys locally is safe if the master key never touches the agent process and decryption is bound to the device keychain. An encrypted blob without a protected master key is just obfuscation.
Wrap the master key in a local KMS, store only the wrapped ciphertext, and rotate encryption keys on a schedule. Audit every decryption event.
Pro Tip: Zero on Fork
Configure the runtime to zero memory and drop keys when the process forks or is inherited, so copied processes start keyless.