It is actually really simple, albeit tedious, to defend your bitcoin against remote state actors. Do keygen and signing with reproducibly built binaries on a reproducibly built minimal OS and never connect it to the internet.