If you're willing to accept that an individual MOSFET won't be bugged, build your own hardware from individual transistors to do all the necessary cryptographic

If you're willing to accept that an individual MOSFET won't be bugged, build your own hardware from individual transistors to do all the necessary cryptographic steps. Run it on a battery supply to avoid power line information leakage[0]. Run the hardware inside a Faraday cage to avoid RF information leakage. [0]: using a lead acid battery so you can disassemble it and verify it isn't bugged.