[systd-basiliskd]

Or put them in a $2 FLOSS Gnuk token/smart card that you can carry with you and still have strong password protection and AES encrypted data at rest with KDF/DO:

https://github.com/ran-sama/stm32-gnuk-usb-smartcard