If you like to only hodl for the next years, it should be enough to generate a public key in order to generate addresses. Therefore you may set up a Electrum-Wallet on a (disconnected) tailsOS, copy the public key (write down your seed!!!!) and shutdown the tails. So there exists no "cold storage" device that can be found by someone else. With the public key: set up a new "watch only" Electrum wallet to hodl your values.
If you want to spend the BTC (some years later), just create a new wallet with the recovery-seed.
This should be the safest way for hardcore-hodlers. 💪🏻