Ah, so hot keys for the LN channels makes sense to me, but the onchain wallet from which those channels are initiated from cannot be signed/secured via a hardware wallet.
I guess you could create a 2 of 3 multi-sig and then use one of those as your hot wallet and keep the other two keys in cold storage as an option, but otherwise no way around having that node hot and heavy
reply