Here are a list of my best practices for creating a paper wallet.

• Generate all keys on an offline computer system, this ensures that you are not using an online system that could be sending your keys across the internet.
• Verify the integrity of the code as well as the integrity of the author, things to check include MD5, SHA1 sums and that author is a reputable contributor to the community.
• Ensure the integrity of the host system being used to generate the keys if your system is compromised your keys could be as well. To mitigate against this I often use a LiveCD based operating system.
• The wallet should not be stored on a live computer system until the fund are intended to be spent.
• The wallet should never be displayed, exposed, or photographed and when possible BIP38 encryption should be enabled providing an additional layer of security.
• Ensure fully random sources of entropy are being used during private key generation, information/randomness should never be provided by humans (I.E. brainwallets).
• Paper wallets should never reuse addresses, and will only store one keypair per wallet. When spending remember all funds need to be removed from the wallet at that time, many have lots coins due to improper transaction generation which can spend the remaining balance in the form of a fee.
• Optional: I prefer to store the paperwallet inside of a tamper evident device, this will ensure that no one else has had access to your private keys (thus protecting them from being stolen)
• Optional: Multiple backup locations of the paperwallet all protected and stored using the same techniques, from a backup perspective I am never comfortable unless I have 3 copies stored in at least 2 different physical locations.

metal stamping on metal that is not susceptible to rust

like gold aluminum etc.

other main risks are loss of funds and theft of funds

loss can happen because the damaged program can have error and generate bad address. the spendability should be tested before with small money.

theft can happen because the program can create not random but known to attacker addresses. this way the attacker can steal funds once user top up the insecure paper wallet.