You can also use bitcoin paper wallet, sign transactions on an offline machine and broadcast signed tx. But it's quite inconvenient to do so. I often hold "large" (from my perspective, it's only few thousand $ worth) amounts of liquid Hive and Leo, so if my active key gets compromised, I could lose it all.

On a clean, trusted, offline PC, and make sure these 2 keys have never been online.

Unfortunately, I don't have any dedicated PC just for generating private keys, so it's much cheaper for me to use my ledger.

With a a ledger, I can generate public key from private key without ever exposing private key (they are generated in the device from seed phrase). Then I just need to update my account keys with a new public key and now even if my PC is compromised, my private keys are save in the ledger and all transactions are signed there. I can even my old keep posting and memo keys and only update active and owner keys.

Beem already supports ledger app.

While Hive is different from other cryptos, there are still just pairs of public/private keys, but there are 4 instead of on just one. The ledger can generate these private keys and give you only public keys, so private keys never leave the device.

When you want to sign a transaction, "you" (app you are using) send a request to ledger, approve it and the signed transaction is returned, so it can be broadcasted.---

While Hive is different from other crypto, there are still just pairs of public/private keys, but there are 4 instead on just one. Ledger can generate this private keys and give you only poblic keys, so private keys never leave the device.

When you want to sign a transaction, "you" (app you are using) send a request to ledger, approve it and the signed transaction is returned, so it can be broadcasted