For single sig self custody, using a vacuum sealer by simply using the “seal” function without the “vacuum” function has proven to be a good way to tamper proof your cloned signing devices that are kept away from your primary residence, while still maintaining the ability to get a charge onto the batteries occasionally for their health. Having cloned devices gives you the option to crush your primary device under your heel, or throw it half a block away, with zero consequences other than not being able sign transactions at that very moment. Location 2 can be a site with alarms and recorded security cameras, or an armed friend’s house who you generally have to call to go visit. A simple agreed upon word can be the signal to set up an ambush during such a call. Worst case, if you lose access to location 2 or have a falling out with your friend, you still have access to your primary signing devices at location 1, which is also away from your primary residence. Location 3 can be a third location for physical seed backups on steel.
Of course multi-sig is easier, but if you’re not there yet or your two of three is usually at home with you, this is about the best defence I can think of against the $5 wrench attack. In addition of course to having a means of projecting force with little or no notice.
