Regarding scalability: not sure about amount of transactions, but I experienced problems with bitcoind when wallet.dat became larger than 300 mb (it just took too long to start, reparse or repair it). Probably that's due to many thousands of change addresses. I expect that if I use raw transactions and store the private keys in my database instead of wallet.dat, I'll be able to scale it.
So I thought about using 2 bitcoind services that interact via mysql database:
1) "offline" bitcoind: 1 listening port for ssh, 1 outgoing port to mysql; database permissions to write bitcoin addresses, private keys, signed transactions; database permissions to read unsigned transactions.
2) online bitcoind: no need in firewall; database permission to read bitcoin addresses, database permission to write unsigned transactions
But maybe armory daemon is a more convenient and secure solution. I'll look at it closer, thanks!