No, that can’t work. You have to sign the concrete UTxOs and the concrete values of the outputs. The node cannot change them at will.
build cannot be run on an air-gapped machine. It needs access to a node for the protocol parameters, anyway. And I’d assume it then also looks in the ledger if the pool ID is currentlly registered.
For build-raw, I’m not sure. Totally possible that you just have to know if you have to substract another 500 ADA deposit and the transaction only gets rejected on submission if you guessed wrong.
Of course. So now I can’t run ‘cardano-cli transaction build’ on my air-gap machine. But all the witness signatures can still occur on the air gap machine so no private keys need to be on the internet connected live node. OK, I will do it the ‘transaction build’ way next time.
Yes. I recall wondering about it when I was preparing my first updated pool certificate and manually not taking out the extra 500 Ada deposit when doing ‘transaction build-raw’.
It is so much harder to help people with all the moving parts in the build-raw way of doing things, especially if it uses a strange combination of temporary files and shell variables and you try to explain that that for sure is not the only way to do it and they have to give you the exact values for diagnosis.