Having an offline airgapped computer with Linux: This looks like the safest option to me. The problem: You need to pre-sign the transactions and Bitcoin Core does not have good support to do this so you are stuck with making raw transactions by hand which is a bit of a mess, then you need to pass this raw transaction into your online node. Armory has a nice GUI to do this but I wouldn't trust it too much. Electrum.. wouldn't trust my main stack to be held by an Electrum wallet (too paranoid about the seed being derived somehow)
I wasn't aware that Armory had a GUI for offline signing. Any opinions here on Armory vs. Electrum? I use the latter, but I'd feel a lot more secure if I could do this with Core. Also, is it true that Electrum's seed might be easier to derive? What's the difference among the different HD wallets regarding seed security?
Im just not sure about the whole deterministic approach thing. I remember reading that it reduced overall entropy. Your seed could also be derived from a number of signatures.. I don't see how it's a good idea to have all these relationships between things and not just have private keys separated from each other like the old wallet.dat format?? at least for cold storage. Achow I think said that the HD format for Core is not bip32 and it's safer than Electrum but im not sure.
I don't know about Armory details but you can see a video in action here (offline transactions in Armory):
https://www.youtube.com/watch?v=ZGjL4BllFtMAnd here how to do offline transactions in Electrum:
https://www.youtube.com/watch?v=DQumISxkJsQAnd here how to do offline transactions in Bitcoin Core:
https://www.youtube.com/watch?v=jWKuqP-zTFkAs you see it's harder with Core, but, if you can do it in the online node with the GUI, then pass the transaction into the offline node, sign it, then pass it back to the node, it could be done easier (with that extra step but it's worth the peace of mind of getting an ideal fee and getting things done in the GUI where it's harder to fuck it up than with crafting raw transactions)