Or move them to cold storage periodically that's air gapped and they are transferred via sneakernet encrypted.