[Vexs]

The hackaday community's mooltipass kind of solves this- puts passwords on an external device with a smartcard. The OS never accesses the whole breadth of it, just what's exposed by the hardware.

I think that's the right approach, but I'm not sure I like the hardware. Something I was thinking about was using a pi zero in a small box, that just does something like emulate a keyboard for password-pushing. Give it a small screen and small keyboard for UI.