Questions about cold wallets and MultiSig

Hey everyone, I’ve got a little issue and would appreciate your thoughts on it. I’m looking to set up a cold wallet using Electrum on a computer that’s offline, and I plan to have a watch-only wallet on another machine running the full node. I want to create a transaction in the watch-only wallet, then transfer the transaction file to the offline computer to sign it there. So here are my questions: Question 1) Do all hardware wallets used for MultiSig need to support PSBT? Or can I use something like Trezor or BitBox instead? Question 2) If Trezor or BitBox can work too, where do I sign the transaction? On the watch-only wallet or on the air-gapped computer? My understanding is that Trezor & BitBox might need internet, but can I do it without internet on the offline machine since the hardware wallets are connected to Electrum there? Thanks a lot!

Probably this can be helpful to know some hardware wallets that support multisig: Jameson Lopp's multisig hardware wallet signing test You may have to connect the hardware wallet with online wallet, like Electrum. Yes the wallet will support PSBT. You will use the online wallet to create the transaction, pass it to the hardware wallet. The hardware wallet will sign it and you will pass the signed transaction to the online wallet to broadcast it. The signing is on the airgapped device. But know that not all hardware wallet are airgapped but they are still the signing device. Internet connection makes the online wallet to be called online wallet.

So as I understand it, it goes like this: I create the transaction on Electrum WatchOnly (Online) Then I export the transaction file and paste it on my airgapped computer Electrum ColdWallet ( Offline ) There I  sign with the Electrum ColdWallet, Trezor & Bitbox. Then I export the transaction file again and paste it into my Electrum WatchOnly and initiate the transaction. The hardware wallets such as Trezor or Bitbox would have to be created online somewhere beforehand, right? Or does it also work offline?

Yes it is like that for wallets on airgapped device and airgapped hardware wallets. But Trezor and Bitbox are not airgapped hardware wallets. You will need to connect them online to wallet like Electrum. Although, during the connection, it is said that the wallet's seed phrase and private keys can not be seen online. I prefer airgapped hardware wallet. If you connect such hardware wallet to Electrum, you will see an option to click on the hardware wallet. But if the hardware go online or remain offline, I do not know. But according to the hardware manufacturer, it is not connected online. I prefer airgapped hardware wallets because it is easy to know that they are not online at all.

hmm so only Coldcard, Passport & Keystone remains as an airgapped wallet which are open source. Unfortunately, SeedSigner doesn't work with Electrum & Jade signs airgapped, but Firmupdate cannot be installed airgapped. Is it possible to connect Trezor & Bitbox to the WatchOnly Wallet so that I can sign there, and then I do the final signing on the airgapped computer (Electrum Coldwallet)

The thing is the Trezor hardware wallet is not an airgapped hardware wallet it requires an internet connected wallet like electrum the only difference is that it doesn’t share the private key with the connected wallet which makes it safe so all this going back and forth between two electrum wallets is still same thing with Trezor, just connect it to an online electrum wallet and that’s all, you can still have a watch only though but it’s not needed in this setup. But if you’re going in for a maximum security then go just use the electrum wallet on airgapped device and create another watch only device for broadcasting of transactions, this setup doesn’t need a Trezor or any other hardware wallet between them.

I don't understand why you have to have internet to sign something, for example Jade doesn't need internet to sign either... Theoretically it should work that you connect the Trezor with an airgap Electrum so that you can sign without internet or am I wrong? But I would like to set up a multisig...

You don’t need internet to sign transaction but you need internet to actually broadcast transactions and that’s why jade hardware wallet is connected to blockstream green wallet or the transaction data is shared using other methods like QR code or usb. The signing is done on the airgapped Jade wallet but broadcasted on this wallet. As for Trezor I didn’t say it wouldn’t work with Electrum airgapped wallet but there is no need for that your Trezor doesn’t share its private key with any connected wallet and that’s basically what airgapped wallet are also for so why having them again in the set up when you can just go straight and connect the Trezor wallet with an online wallet that will be used to broadcast the transaction after signing. You can simply setup a multisig with the three wallet, a 2-2 multi sig wallet will be ok (although I don’t like the idea I prefer a 2-3 multisig wallet). One signer will be on the Trezor hardware, one will be on the electrum airgapped wallet and then a watch only wallet for signing the transaction. The must important thing is to never have your consigning wallets generated or signed using same device