What is Hardware wallet?

The device signs internally and returns only the signature, so malware on your computer cannot extract the key. It also displays the destination address on its own screen for verification.

Buy directly from the manufacturer. Devices bought second-hand or via marketplace resellers have arrived pre-seeded with an attacker's phrase often enough to be a recognised category of theft.