You can do everything offline / airgapped. Instead of introducing *another* hardware risk (signer) I could easily just use sparrow on a clean / offline machine. The passphrase also is never stored on the machine anywhere and is never shown in the process of wallet setup.