You can just use a pixel with graphene OS installed 
Maybe a seed signer In a multi-sig combination

Secure
and it doesn't scream "I'm securing private keys"