That similar to what I was thinking too… instead of carrying around a device, why not have a server that is physically secured somewhere and connect with Wireguard? It could be at home or on a cloud, if you trust that.

Tailscale and wireguard are available for all major devices, including mobile. So, if you do this, your password manager can live anywhere and doesn’t need to be exposed to the main internet at all. You don’t even need SSH/network access to the remote machine, just HTTPS over Wireguard (and local or console access). Everything else can be locked down tight.

My understanding of tailscale is you give full access to the tailscale company to allow any public key to access any of your machines.

I think I'll stick with running my own wireguard thanks.