Big fan of Yubikeys. Tails would need persistent storage to use one, but you can airgap keys with Veracrypt + hidden volume.
Here's a fun tutorial for generating and airgapping PGP private keys using GnuPG, Tails and YubiKey :)
https://github.com/sunknudsen/privacy-guides/blob/master/how-to-genera...