tails + xpassxc + sparrow

and borderwallets and/or shamir for backup.

is that bulletproof? no.

is there a better option? also no.

you can't even trust any hw (e. g. intel me) anyway.