Coldcard + Sparrow. There isn't even close to a second best option imho. Full stop. Ledger is spying on you and can extract your seed remotely. Trezor One an expert can easily forcibly extract the seed in minutes, if that. Stateless signers border on a scam unless you are so strapped for cash you literally cannot afford anything else. Having QR codes lying around with all of your wallet info is insane from a security perspective. If you constantly have to handle and input your seed, eventually someone will be able to steal it if they're patient and you're doxed.