There are no ideal solutions but Coldcard is the best imo. One flaw is they are source viewable but not fully foss. Also I don't think it's possible to get a foss secure element. But I believe Coinkite are good actors and really know what they're doing. Check out some NVK podcasts (Bitcoin Review etc) and if you like NVK you'll probably like Coldcard (he owns the company)