I like this idea to reduce dependence on trusting any given algorithm.

If I'm a global passive adversary, I would try to attack your blobs in these ways:

1) weaken your random number generators

2) guess your password by running massive dumps of passwords and passwords mutated with rules against pbkdf2 (why didn't you use scrypt?)

3) try to convince you or your system to decrypt a blob and reveal the plaintext to me surreptitiously (not so passive)

4) try to get your password from security flaws in wherever you store it

5) conduct traffic analysis on who is storing blobs where and when, and how long their blobs are

My bet is that the password is the weak point. Can you do anything to address that?