Id just have a dedicated Graphene phone with a strong passphrase and Stack Duo .

but maybe your threat model is different.