Use an offline wallet. Never let this device to go online.

Whenever you will need to broadcast a tx, take the master public key, create a watch only wallet using this master public key in a device which is online. Then create the tx and save it, take saved file in the offline system and load it. Sign it and save it. Take the signed file in the online system. Load it and then broadcast it.


You are not going online with your original wallet ever.