You could try using the free version of APK Permission Remover to remove what might be unneeded permissions from the APK before installation.
That looks interesting and potentially useful. Thanks! But how do you get the APK of Google Play Store apps without first granting permissions/installing them?
As I said, I got in touch with the folks at Enpass asking for a refund. They got back to me and said that they don't use the location permission, but somehow through their use of Google Play Services (GPS), the GPS library automatically added the location permission (against their will/knowledge). So they're working on releasing a new update without the location permission.
Also, I realize as I'm writing this that when I abbreviate Google Play Services as GPS, you may think I'm talking about Global Positioning Satellites (or whatever GPS usually stands for) which would logically require location permissions. But I'm really talking about Google Play Services, which doesn't necessarily have anything to do with location.
In summary: I'm giving Enpass some time to remove the permission before I continue with my stink about it. Hopefully they make it right.