Hardware wallet or signed messages from an air-gapped laptop?

This site's own Bit-SIGN login got me thinking: for cold storage, is a dedicated hardware wallet still clearly better than a clean air-gapped machine?

Hardware wallet for the supply-chain paranoia alone. The laptop's history is unknowable.

Air-gapped laptop with a minimal OS has served me a decade. Discipline matters more than the device.