Imo seedsigner is a good option. No dedicated signing device, so less likely to be compromised. Fully air-gapped. Create your own wallets from dice rolls. And with BIP85 you can have multiple wallets derived from one seed.