Thats the usual chicken + egg problem. Thing is, i don't trust LastPass or any other commercial solution at all, because there is no public auditing possible. And LastPass has had breaches so there is precedence.

But I really get where you are coming from, as we are also a SaaS Shop that has to walk that particular line.