you buy a pixel phone, you install on it grapheneOS, and then you install on it cupcake, or ashigaru, and you never connect it to internet.

couple of tweaks in the setting and no one will access your keys, unless you chicken out.

or, memorize your seed phrase in a poem.

but yeah graphenoOS is very difficult for them to crack