Multisig with passphrase. You control all sigs, and all are readily available. Always watch-only wallets on your internet-connected main device, you create the transactions there and use a secondary offline-only device to sign them. Use Childseeds(BIP-85) to generate extra wallets for different purposes, you don't have to keep track of those seedphrases because you can always generate them back from the parent seed. Never use single-sigs a without passphrase. When using multisig, use Taproot whenever you can (extra privacy and lower fees). DYOR.