The main concern you have right now is that your backup scheme has a single point of failure. If your backup were lost / stolen / destroyed, then your funds are gone.
The easiest way to improve your current security model is to implement a passphrase: https://support.ledger.com/hc/en-us/articles/115005214529-How-to-set-up-a-passphrase-?docs=true
A passphrase allows you to generate an entirely new wallet using your existing seed. You'll require both the passphrase and the seedphrase to recover the wallet. This makes it more difficult for an attacker to steal your funds, as they need both elements, but on the flipside it means you also have more things to back-up.
Much like a password, the longer a passphrase is the better. 6-8 words chosen from the BIP-39 wordlist is a good strategy: https://www.blockplate.com/pages/bip-39-wordlist
An example back-up scheme would be the following:
  • HWW loaded with seed @ location #1
  • Seed on physical paper / steel @ location #2
  • Passphrase on physical paper / steel + HWW PIN @ location #3
  • Passphrase + PIN memorized
This setup has no single points of failure. If one back-up is lost / stolen, the funds are still safe and recoverable.
It's good practice to have back-ups stored at different geographic locations you are able to access semi-regularly, although judging from your post this may not be possible. It's also good practice to store back-ups in anti-tamper packaging so you know if they have been accessed.
How might you change this, if you were using the SeedSigner, or any signing device that does NOT store the seed on it (stateless)?
reply
I'm not familiar with that brand of devices so shouldn't comment.
I assume one would need an additional seed backup at minimum if nothing is stored on the HWW.
reply
Great question about using stateless signing devices for enhanced security
reply