In that case why not use an air gapped setup, hook up a watch only wallet on your node and use an airgapped device to sign psbts