So yes, this is about as good as you can get. The more keys are required, the better.
The problem is, lakano, once a stored key is unwrapped in Web Crypto, I don’t think there is a way to mark the result as “non extractable”. I wish there would be a way to combine wrapping and “non extractable” keys. Have you found a way?
I have been asking for a year and no one really knows: https://gist.github.com/saulshanabrook/b74984677bccd08b028b30d9968623f5