For the record, I didn't store keys inside a Google doc.

I found a backup txt file and the keychain kc file on my Google drive.

Out of curiosity, when credentials are exchanged between keychain app, or any apps, and a user, is there some server session cookies at play? If so, could a server session cookie be highjacked?