Would suggest a further security improvements: Remove harddrive and bluetooth also. Run TailsOS from UBS drive in non-persistant mode on that airgapped Lenovo. Sign psbt with pre-installed electrum wallet.