A public derivation of the masterkey for generating addresses is much better than P2SH enforced.
I respectfully disagree. If the server you use has the only copy necessary to spend your money then you are in an entirely different realm of banking. My solution proposes that you are in full control of your money and the "bank" is only there to provide some convenience.
!!! Public derivation D'oh. You're right! You're doing Bip32 public key derivation using a single key. For what it's worth, I'm the author of the javascript bip32 implementation at https://github.com/sarchar/brainwallet.github.com/blob/bip32gen/js/bip32.js
The point of multisignature (whether it's p2sh or not) was to provide some backup in case of lost keys.