> the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs.

Consider encrypting the filenames with Fuse+EncFS. This flaw is pretty huge elsewise; it's why I changed to using gnupg.vim+SublimeGPG.