Did you know?
If you Multisig quorum on the hardware signer, then it can verify the change output?

In @Bitcoin-Safe this is step 3 in the wallet wizard.

Best practices, baked into @Bitcoin-Safe