Definitely some good things to digest here. Another approach, especially if you are a Windoze user, is to set up a VM with no network connection. You can encrypt the VM drive like BitLocker, then encrypt the VM file for cold storage. The OS in the VM can be anything you are comfortable with.
Remember that the Raspi OS was probably downloaded from the web, so it isn’t completely pristine (though probably more than good enough)...