making sure a small part is very secure vs having to verify every domain I visit? yeah, let me keep using the current system… are you aware of the amount of domains you connect to every day?
Also, I might be wrong, but if I remember correctly browsers/OS-es tend to come with a list of trusted certificate keys already, which makes adding compromised keys to that list not as easy as you suggest. (I don’t even know if that happens or if they just update as part of security updates of OS/browsers)
One thing to think about is the encryption quality of a zip file, which I ignore.
One danger that I see is that you have the risk of having the passwords on the clear all over the place many times. Not an expert so don’t quote me on this, but password managers are careful avoiding passwords on the clear as much as possible.
I don’t trust any online service for that, I am using keepass/syncthing for myself, with android as the only client decrypting (as I always have my phone with me). one example of advanced security measures is that while using the app I can’t take screenshots, and I hope/expect that it uses images backed by secure memory to show them to me and is careful with things like RAM and temporary files (didn’t check personally though, although being open source I could)
Having to be sure that your zip app handles that seems like a hustle honestly. On top of having random passwords without the biases I would add for each separate site.