I like the cut of your jib. Avoiding the wrench attack by all means necessary is the best option. Multisig, multiple hw devices, duress pins and fake accounts, just add complexity that won’t do much good when the car battery gets hooked up to your nipples.