The information at Issuing a New Operational Certificate - CoinCashew is worth reading carefully. Prior to Vasil, as we know, the value of node.counter for an operational certificate may be any value that you choose, as long as the value is greater than the highest value that you used previously. Issuing a new operational certificate automatically increments the value of node.counter by one (1) in anticipation of issuing the next certificate. After Vasil, the node.counter value must be consistent with the current counter value for your stake pool registered on the blockchain by the protocol. If the node.counter value of your operational certificate does not correspond with the counter value that the protocol maintains, then the network will not accept blocks that your stake pool may mint because the operational certificate is invalid. If your stake pool mints at least one block using each operational certificate that you issue, then your pool is less affected by the changing functionality related to operational certificates after the Vasil hard fork. If your pool mints blocks less frequently, then after Vasil you need to get into the habit of setting the node.counter value manually when issuing a new operational certificate.
Also, Cardano Node 1.35.3 seems to require the libsecp256k1 library installed on the offline, air-gapped computer as well. There are some approaches for installing the libsecp256k1 library without connecting to the Internet in the post at Updating Offline Nodes The same information is scheduled to be included in the next release of the Coin Cashew guide as well.
CHG