It gets finalized on the cold card if it’s just a single signature it needs. The computer just broadcasts the signed transaction to the network using whatever wallet software or node you’re connecting the file to.