This is the architecture of Qubes OS. It can be used to create secure vaults WITHOUT covenants. One VM to use covenants and get pre-signed transactions based on output restrictions. Another VM which generates a private key, creates pre-signed transactions and securely destroy the key.

https://image.nostr.build/973696c8b3954faeeba57e3e461c372df777c2a29806b1e145d499b9f88770bc.png 

 What about the HW spyware module inside CPU that sends secrets to NSA? 

 https://www.qubes-os.org/hcl/#purism_librem-13-v2_i7-6500u_integrated-graphics-hd-520_kyle-rankin_r4-0 

 Trezor will be safer even without vault covenant. Adding complexity and reducing security doesn't seem like a good direction