Best way to secure authenticator app itself?

air gapped pass key :thinking: