"... this impossible requirement ..."
You can literally go ahead and use it today. It's not even especially difficult.
For example, here is a cold storage identity if you'd like to see one in action:
The privkey for that one has never come close to a networked device.
Inkan
Inkan web client
