A year ago I would have said cold card.

But I think specter DIY is less vulnerable to supply chain attacks similar to seed signer.