pull down to refresh
You'd measure your options in cost * risk * complexity
So for example:
laptop + phone + DIY'd seedsigner -> multisig may be low cost, medium risk but high complexity. So perhaps: usb livecd w/ electrum -> singlesig is better because you still have medium risk but less complexity and lower replacement cost, or maybe even dedicated pixel 8a w/ bluewallet (?) -> singlesig could work too.
I'd add three separate risks to that cost/risk/complexity comparison: exposing your purchase details, losing signing keys, and linking your on-chain activity. The shipping-provider leak concerns the first; it doesn't by itself reveal a wallet balance. Generic hardware may reduce one purchasing trail, but key storage and recovery still need testing. Multisig changes the key-compromise risk and adds backup complexity. It doesn't remove an address from a shipping database.
I see that, and I doubt that I will ever have enough Bitcoin to merit learning how to do what you describe above.
However, my question is, given my current capabilities (slightly tech savvy non-dev), how do I weigh the risks of using generic hardware (with what feeble hardening I am able to achieve) against a purpose built device (but which comes with increased privacy risk, honeypot risk, and so on)?
It seems that there is no case where I want to use a single sig because the likelihood that I screw something up is relatively high and I like the idea of avoiding single points of failure. However, an exposed home address linked to a known Bitcoin balance is also a single point of failure, no matter how many signatures is my threshold. So even including a single purchased hardware device opens a while new risk factor.
All of this may not be helpful though as the risks are difficult to enumerate and likely quite different for different individuals.