I am amazed no one suggested a simple GPG operation. Generate a keypair on an airgapped machine, keep the private part on a secure external medium (eg. CF Card

I am amazed no one suggested a simple GPG operation. Generate a keypair on an airgapped machine, keep the private part on a secure external medium (eg. CF Card in a bank safe). Have the public key on your normal machine, write your journal in normal text files (use a ramfs if you worry about it being restored by forensics) and encrypt against the public journal key. Decryption is only possible with the private part, the public part can even be, well, public. :)