Well, if the user is, say, running a RaspPi with a CLN node + bitcoind, it would be possible to buy an STM32 device and run VLS on it (though I don't know if that fits with "moderate" technical competence, heh), and connect it to your RaspPi via the USB port. We have a proof-of-concept code for this, though there are pretty big gaps, but at least it would isolate the key away from the RaspPi itself.
Well, if the user is, say, running a RaspPi with a CLN node + bitcoind, it would be possible to buy an STM32 device and run VLS on it (though I don't know if that fits with "moderate" technical competence, heh), and connect it to your RaspPi via the USB port. We have a proof-of-concept code for this, though there are pretty big gaps, but at least it would isolate the key away from the RaspPi itself.