Make a multisig cold wallet. Sign a transaction to your staging wallet with an nsequence time lock so that the staging wallet can't spend the keys for lets say, a week after receiving them. With miniscript such that in that time you can live it away from your staging wallet if a wrench attack is why you moved it. Keep the multisig cold wallet backups off site way out of reach. Keep your presigned at home or at least more convenient.
You can tweak this in a lot of ways, but its a basic rubric. Its how https://rewindbitcoin.com/ makes their service work (though their cold storage is single sig AFAIK).
