I think this can be easily solved using process/app isolation, i.e. KeePassXC doesn't need network connectivity.