The Trezor password manager software years ago was buggy and caused catastrophic loss...long story. The removal of that software did the BTC community a favour. FOSS like Trezor is still better than the proprietary cold wallets and I acknowledge today's Trezor product and support has matured.
I've decided to use TailsOS on a USB as a cold wallet, cautiously on a private air gapped computer for occasional use. Yes, the commerical cold wallets are more secure, however I intend on rarely using the cold wallet with majority BTC funds. Once trust and better use and understanding is developed, spending money on an expensive commerical cold wallet may become an option.
I think for frequent use like when travelling and needing to top up the hot wallet, a 2nd TailsOS on a USB as a cold wallet with fewer BTC may be practical and secure.
BTC only is fine, but Electrum according to research cannot move the mnemonic/seed phrase and passphrase to other BIP39 wallets (in the event of Electrum being compromised).
The hassle of creating 2 new mnemonic/seed phrases on 2 stainless steel hex keys, makes it worth finding a wallet where mnemonic/seed phrases can be recovered on any BIP39 wallet.
Therefore, I will use Sparrow on TailsOS.
Coinomi cold wallet is considered for using non BTC, like PoW Doge or PoS Monero, but I don't see any need for private transactions at the moment.
The plan is to transfer BTC from the cold wallet to a hot wallet like Breez/Blue/Phoenix (self custody, FOSS but missing reproducibility like Mycelium) with LN capability for daily transactions.
- Mnemonic/seed phrase storage SSSS confused for multisig
I was confusing multisig for a way of protecting the 2 stainless steel hexkeys mnemonic/seed phrases, however realised multisig is for transactions like 2 of 3. SSSS is for "splitting" mnemonic/seed phrases, however this is not recommended and I prefer to follow cyber security best practices.
That being said, multisig can be used as a form of SSSS, as long as the public keys are never lost. Storing public keys in multiple locations on the cloud should ensure the multisig public keys are never lost. Therefore, multisig can be used as a form of SSSS for mnemonic/seed phrase 2 of 3 storage, if choosing to not follow best practice of 2 stainless steel hex keys store in 2 locations (preferably covered with tamper proof stickers over a ripped piece of signed and dated paper (photo stored on cloud to view any tampering)).
- Side note: passphrase inheritance
Store passphrase on a cloud password manager, with emergency access to trusted people, which you can reject in x amount of time, if receiving access requests
or a timelock (haven't found any free services for this)
This passphrase inheritance seems to progress digitising confidential documents, which legacy legal practices charge an arm and a leg to store paper in a fire proof safe.