[myself248]

And you can use keyfiles that you sneakernet between devices at setup time, so those are never exposed to the syncthing shared folder. I don't think this adds much security since presumably if someone can compromise your syncthing secrets, they could probably grab your keyfile too, but in the event of a syncthing vuln that doesn't lead to other filesystem access, it might help.