Generate a private key and put onto a write-once device like TapSigner. Maybe with the help of a company that helps you with tools and resources but remains blind.
The device can sign for anything, custom message, tx with custom derivation path, lightning txs, multisig, script txs.
It will NEVER reveal the seed words inside. (Unlike the tapsigner actually)
Seed words go concealed into a safety deposit box and is protected by legal structures and corporate stuff that is acceptable. Maybe there are options for the renegade too.
Tapsigner can be snapped (broken) if you are under duress.