When you clone a new air gapped signing device from another, you physically transfer the SD card from the original device to the new device in order to transfer the key information, and then you wipe that file off the SD card. Once the file is used in the process, you don’t have to have it residing on the SD card anymore for the clone to work. It’s all on the secure side of the new card at that point, behind a PIN. It’s good housekeeping to keep all of your actively in-use SD cards empty after the files on them have served their purpose. If you want to store an encrypted wallet backup file for instance,(or any other file used to interact between two devices) on an SD card, you can keep that SD card somewhere else, rather than in one of the devices. Encrypted backup files carrying key info also require a separate key for future use anyway. It’s bomb proof.