You can't really have cold Nostr keys like with Bitcoin. Depending on OS there are options for signing software to decrease the attack surface, but the keys will be on an Internet connected device somewhere. Android has nip-55, supported by Amber, Nowser & Aegis. For other OS there is nip-46 for remote signing, using bunker software.