he's already set up with a coldcard, but hasn't done much else hardware/security wise, have thought about a stampseed maybe