Use only hardware wallets with no secure element but be clear on how to make them non-vulnerable.

- Jade (not vulnerable)

- trezor T (vulnerable, must use passphrase or enable sd protection)

- Next trezor with tropic chip (open hardware)