I'm guessing the best way to go about self custody these days is to have a multi sig wallet, based on multiple hardware wallets from different vendors.
You're better off just having a dedicated laptop for crypto transactions.
Actually the only one I know is the Gnosis Safe. Talk about creating a huge risk if it would have a problem.