I think you've got to geographically distribute & obfuscate your keys, then destroy your home copy and keep the hardware wallet with passcode(s) in your Bug Out Bag