I would suggest using a live-Linux-system, that is completely readonly. I would suggest using a USB memory with a physical write-protect switch, that prevents any modifications to the system (here is one: http://www.amazon.com/Kanguru-Flashblu-4GB-Flash-Drive/dp/B0012WDFV6/ref=pd_sim_e_1?ie=UTF8&refRID=1XS70KSFXBNH0PFQF3T9 ). Some laptops have internal USB ports so the write-protected USB memory could easly be integrated in the laptop, but else, you could use a USB 2.0 to miniPCIe adapter, ( like this: http://www.drivestar.biz/converter-mini-pcie-to-usb-20-p-3414.html ) to replace the Wifi card with a write-protected drive. Whatever you do, Always remove the Wifi card and other Connection methods to computer. If you then use Armory or similiar bitcoin client, you can even make the keyseed read-only.
Then I would suggest using a "memory" smart card to transfer unsigned transactions to Cold computer and take the signed transactions from Cold to hot.
A memory smart card does not have any protection of its content, but its advantage is that the memory space is SMALL, so it would be cumbersome for a virus infection to be stored inside a memory smart card.
Another thing is that data on smart card is NEVER EVER executed automatically by a OS, it will Always be treated as data. A third advantage is that you have very limited storage space on a memory smart card making buffer overflows simply impossible since you can allocate a buffer that is larger than the smartcard without any RAM problems.
I would suggest using a ExpressCard Smartcard reader, that can be inserted and then permanently affixed to the computer with expoxy glue or using tamper-resistant labels, OR making sure to gain a laptop computer with a built-in smartcard reader.
There you have a good Cold storage computer.
To make the initial setup of a Cold storage computer, boot a regular live-system off a standard USB drive, to use to "master" a new live-CD system on the write-protected USB drive (ofc with its write protection turned off). The mastered system should of course only contain the live-OS and the software used for signing (OpenSSL, Armory etc) AND generated keys. Since the computer is offline, the keys you generate on the "insecure" regular live-system will NEVER leak. Then you remove the memory you stored the regular live-system on.
But IF you noticed the key leaked or you did a mistake, then its as easy as not using that key, and start over from step 1. So the key becomes secret once you decide the key is secure and unleaked and you decide to start using it. Before that, the key isnt even a key, its just a bunch of random bytes.
Destroy this USB memory, either physically, or overwriting the data with DBAN. (Note: NOT the write-protected USB memory, you destroy the USB memory used to boot the regular live system)
After this, you switch on the write-protect switch on the USB memory INSIDE computer, Before you boot up the live system for the first time. After this, you boot up the live system, then you VERIFY that all files are intact and unmodified. You could for example check SHA hashes of the armory client, check that OpenSSL is the official one, and check other Components of system until you are Confident that nothing modified the system.
Since the USB memory is now write-protected - NOTHING can change the content. Seal the write-protect switch with some tamper-resistant security tape, and then seal the doors on the laptop with tamper-resistant security tape. Seal all screw holes using tamper-resistant security labels. Now you are Confident that even someone with physical access to the computer cannot covertly install any software on the computer. Since its a laptop and all doors/screws sealed, they cannot even install keylogging hardware since the keyboard screws are sealed aswell.
Use expoxy glue to seal all ports on the computer, but leave one USB-port open in case the system goes bad and you need to recover/reinstall something. SEAL this open USB port with a tamper-resistant label.
Backup your secrets by displaying them on screen and Writing them down carefully on archival paper with a permanent marker pen. Then store this paper in a safe or something. A bank box is even better since all accesses to a bank box is audited.
On Armory client, you simply write down the Words displayed. The Words contain all information required to restore the key.
Of course, you can also write down the seal numbers on this paper, making a good record that you can backtrack to INCASE you suspect someone did replace the taper-resistant labels.
There you have a very secure setup.