The software referenced two posts ago has matured greatly in the past 3.5 years. The 0.7 release is out, and in addition to the handling of multiple tokens and QR code token export from prior versions, this release bring GPG-encrypted configuration files.

If you have one secret key, Oathmeal will use it and encrypt your configuration. If you have more than one, it will offer you a choice at launch. This brings the added benefit of allowing you to have multiple token stores. Oathmeal handles migration from the old configuration format for you; if everything works as expected after upgrade, you may delete the old version of the configuration file, now at ~/.oathmeal.conf.old.