Matrix also provides the ability to back up keys in the server, but you select a separate passphrase for encrypting them before they're uploaded.

(Yes, it would be nice if the user didn't need two passphrases for this use, but Matrix cannot safely revert to key derivation because client could accidentally leak the master password to the server due to existing implementations.)