I would do this in phases to avoid overwhelming all at once. Expect lots of questions.
VPN first (mullvad or ivpn)
Then order a coldcard, or other suitable HWW direct and initialize
Setup Sparrow, preferably pointing to their own node, or yours over Tor, or a known "ok" public electrum server
Import Xpub from initialized HWW into Sparrow
Withdraw to an address shown in sparrow that came from the HWW.