Big fan of Yubikeys. Tails would need persistent storage to use one, but you can airgap keys with Veracrypt + hidden volume.
Here's a fun tutorial for generating and airgapping PGP private keys using GnuPG, Tails and YubiKey :)
https://github.com/sunknudsen/privacy-guides/blob/master/how-to-generate-and-air-gap-pgp-private-keys-using-gnupg-tails-and-yubikey/README.md
Old-school with multiple devices does the job too. How long has it been since you used Qubes? There's been a lot of upgrades recently that have improved the UI/UX just over the past year.
Honestly can't imaging daily-driving anything else at this point unless Joanna builds something cooler, but IMO it's going to be hard for her to top Qubes.
