Sorry to butt in on this. Are you having trouble with how the signing happens without the cold wallet going "online" as in connecting to another internet connected device? ColdCard is the only device I have experience with, but signing can be done over SD card, or USB transport.
Your other question: Why use hardware over seed import. There is never a trace of your private key on the "hot" device. You'd "never" have to worry about leaked private key data if it never leaves the signing device.
It may be worth looking into the secp256k1 algorithm to understand what keys are, how they are generated and stored etc. Oversimplified: if you can securely generate a 256bit number that is valid on the curve, you have your private key.
Some examples from coldcard that might help