I've recently tried out a Nunchuk & Tapsigner combo on mobile, for a modest-sum, daily use mobile onchain wallet (suited for travel). More secure than a mobile hot wallet in itself, but still very con...
Tapsigner isn't a hardware wallet, it's a blind signer. It's great for single-sig on Nunchuk, and a good option for one of your three keys in a multi-sig configuration. You could do a Tapsigner, a hardware wallet, and a software key. If you want more protection, a Nunchuk will store an encrypted 3rd key on their server with a subscription.