TailsOS KeePassXC VeraCrypt = true digital sovereignty!
Let me walk you through how paranoid anons and high-threat-model users actually encrypt and protect sensitive data.
1) Buy a used ThinkPad X270 (~$150).
Great Linux support, removable RAM, easy teardown.
2) Remove all radios & persistent storage: Wi-Fi/Bluetooth, WWAN/LTE, SSD, webcam/mic, battery (optional).
You now have a fully air-gapped, non-persistent machine.
3/ Flash TailsOS to a USB drive from an internet‑connected machine, then boot the ThinkPad.
Now you have completely air-gapped and stateless hardware an amnesiac operating system (TailsOS)
Store the KeePassXC database inside a VeraCrypt container for real defense-in-depth against software flaws and supply-chain compromise.
Congratulations, you’ve built a setup designed to withstand nation-state-level capabilities, with encrypted data easily portable to microSD and suitable for secure, redundant backups.
if you really really wanted, you could could probably keep the mnemonic within tails built in KeyPassXc app encrypted behind a heavy password