reproducibility and library audits are the real hurdles. signing device is a better term. i'd still trust a coldcard over an online laptop though. air-gapping changes the attack surface.
Have fun connecting a 9 volt battery to a Mossad spyware.
1