Seems to be one of the best solutions. But I'm thinking about mass adoption of No-/Pre-Coiners (NPC).

They're great but there's gaps. You pull your seed out every time you sign. No secure boot, it'll run whatever's on the SD card. And no anti-exfil, so dodgy firmware could leak your seed through your signatures and you'd never know. Always check your image.