You are correct - that's the main reason I wrote the 1pass wrapper mentioned above. It mirrors the data locally (in a gpg-encrypeted cache).