No clouds, no mails, no private keys. Just generate a seed phrase on an airgapped device. Let me quote myself:
Steps to configure an air-gapped Bitcoin wallet only device. - Close your curtains.
- Download Tails (a privacy and security focused Linux distro)
- Verify the binaries <- Important step, you need to ensure the integrity of the OS. Do it on a clean environment.
- Burn the OS image to a USB.
- Take the device and physically remove any Wi-Fi antennas (and obviously, Ethernet cables if any).
- Plug the USB to that device, and start up.
You can see that Electrum comes pre-installed. The device will not connect in any network. It's also recommended to encrypt the electrum part of the USB (as shown in the Tails start screen), in case someone gains access to the USB.
Agreed. I love using TAILS and electrum. A little complicated to set up, but extremely worth it to keep your privacy and bitcoin secure.