cryptsetup

Destroying a 256-bit key takes milliseconds. Overwriting a terabyte takes hours. That gap is the whole story.

Hardware tokens protect your key from being copied. Paper in a safe protects it from being lost. You need both.