De-paywalled:

https://archive.is/kRzBj

The most simple answer is don't. Divorce it from the device, fully encrypt it and transfer it separately from your friend.

Then, when traveling, have your friend carry a separate completely clean phone. If he's suspected and the phone is compromised, it won't be found.

When you say state actor, it implies that they're efforts are funded with and armed with the vast resources of a nation which means they could manipulate regular citizens, police forces, or potentially bring a considerable military force to bear against this problem, so the most effective approach would be to separate the person from the information entirely.

this. keeps it simple, air gap.

I have actually and thanks for the suggestion. So far it's my favorite playground tool, but admittedly I've only used this one and SOAPUI