You can always use an encrypted USB drive. I've used these a lot: https://apricorn.com/. Source: over 1 year ago

Yes, the stick I’m going to get requires no software to decrypt it’s all done on the hardware. Here it is. Source: about 2 years ago

You will want a hardware encrypted external drive such as this: Https://apricorn.com/aegis-padlock-ssd-usb-30-solid-state-drive-faq. Source: over 2 years ago

It depends on what applets you rely on. If they're GPG/PIV/HMAC-SHA1, then one of these https://apricorn.com/ with software encryption on top of them, only accessed on an air-gapped machine is as flexible as it gets (more tricky, but equally flexible (and much more expensive) is the YubiHSM). Source: almost 3 years ago

One of these: https://apricorn.com/ plus LUKS encryption on top of it is pretty damn great if you only interact directly with it on air-gapped machines. Source: almost 3 years ago

You can use cloudendure.com, bought some time ago by AWS to make it's technology free for any_to_AWS move, agent based that will copy bit-by-bit and you can test vm on the other side before final cut on source side... Source: over 2 years ago

That being said, I'd still vote for the rearchitecing part, at least to the level what you were describing. If you do decide to lift-and-shift tho, we just completed a big migration with CloudEndure and I can recommend it. Source: about 3 years ago