Seems like a good time to remind folks of the great multisig guide from seedsigner. Even if you don’t have a seedsigner there are some great bitcoin security tidbits in here like the section on “Creating Secure Private Keys in a Trust-Minimized Way”.

The ColdCard exploit is a great reminder of the importance of minizing vendor risk. The same exploit could have been found in SeedSigner or any other vendor. If you aren’t making an effort to take vendor risk out of each part of the process then you should re-evaluate your strategy.

https://seedsigner.com/seedsigner-independent-custody-guide/