Hardened and encrypted devices don’t matter for shit when you’re forced to unlock them. Not having direct access to confidential data like you proposed is much better. But better but even have a way of accessing it that could be detected.