What are my options for storing NXT outside of a centralized exchange?
In the blockchain through the client.
If you don't want to download the blockchain, try mynxt.info or mofowallet.com. mynxt.info also have andoid and iOS apps.
I'm very careful about what I install on my computer. Can I install NRS in a sandbox somehow? I suppose I could run it as a very unprivileged user. I use Linux BTW.
I think a web wallet is too risky.
Would Jay be a good choice?
jay with
http://jnxt.org/nxt can work well as a Web wallet solution, also nxtvault is an android version of jay. For secure cold storage I would suggest
http://jnxt.org/vaporHow does that work? Wouldn't I be trusting jnxt.org?
With vapor on an offline computer you are trusting no one, there is no way for your private key to even get to the jnxt servers, you can also use the nxt today android app to broadcast the transactions vapor creates to the network through qr codes.
Jay works in such a way that the client is locally downloaded and holds your private keys and is only in charge of signing transactions, those transactions are Givin to it by anything with jay.js like
http://jnxt.org/nxt Neither of these setups ever allow your password to be given to jnxt.org in the first place, so minimal trust is assured.