samurai for on chain (they can explore privacy stuff later). something like phoenix for lightning then a seed signer for a hardware device.