I keep mine in an air-gapped wallet with an x-pub loaded so I always have plenty of addresses to use without having to touch it and then run my node over tor, if you're not running your own node and generating your keys offline, is it really your wallet?