Use multisig with private keys created offline on different devices (preferably secure systems) is the best way. Don't forget to have a disaster recovery plan.. loosing keys is as common as theft is.