Just having the ledger in cryptomator works fine for me. Not sure how secure it is.