Our estimates are consistently half of reality

Because they estimate the work, not the day. A useful correction is to track a personal ratio of estimate to actual over a few months and apply it openly rather than padding silently, which reads as sandbagging when it is discovered.

Fix the date and vary the scope, explicitly and in writing, with the cut list agreed before work starts. The failure mode is holding both fixed, which does not change the outcome, only when everyone finds out.

Keep the buffer at the project level rather than per task, and make spending it visible. Per-task padding disappears into Parkinson's law; a shared buffer with a burn chart stays honest because everyone sees the same number.