That similar to what I was thinking too… instead of carrying around a device, why not have a server that is physically secured somewhere and connect with Wiregu

That similar to what I was thinking too… instead of carrying around a device, why not have a server that is physically secured somewhere and connect with Wireguard? It could be at home or on a cloud, if you trust that. Tailscale and wireguard are available for all major devices, including mobile. So, if you do this, your password manager can live anywhere and doesn’t need to be exposed to the main internet at all. You don’t even need SSH/network access to the remote machine, just HTTPS over Wireguard (and local or console access). Everything else can be locked down tight.