"He cannot be sure his phone or device isn't compromised." Well first he absolutely needs a new computer, and a new usb drive that he never used on any of his

"He cannot be sure his phone or device isn't compromised." Well first he absolutely needs a new computer, and a new usb drive that he never used on any of his other devices. Install some linux distro on his usb drive from the NEW device with full encryption, remove the hard drive, then use PGP from the usb drive. Then the USB should stay in an absolutely safe space, with a physical way to know if someone tampered with it(maybe same for the laptop, UEFI virus are a thing) But all of this doesn't matter if he lives in a country where they can just torture you to get your password, in that case you may be able to have a decoy partition with innocent looking stuff on it.(actually you shouldn't even save any sensible information even on the encrypted partition, but there could still be salvageable remnants of it)