I beg pardon, but this part is a nonsense because AES is a symmetric cipher.

And even if you use public-key crypto, the schema's not better than old plain OAuth 2 tokens (or alikes). Actually, it's worse because of unnecessary complexity and because, as opposed to encrypted password, OAuth token has no relation to password at all.

Lose the encrypted key and until you change the password or revoke phone's key (so encrypted key would be unusable) you're not secure. Same with a token except that you don't have to change the password, just revoke a token.