What's the difference between creating entire transactions offline/online? The chain code could be input manually into the offline computer, along with a number determining the indexes of the deterministic addresses to be created, the online Armory will simply check if the transaction is valid and no private key will ever get onto the online computer.
I'm not sure I understand your question. The online computer already never touches the private key data. It is created on the offline computer and stays on the offline computer. Only the root
public key is transferred to the online computer. Even all the data moving back and forth between the two systems is totally security-insensitive -- no private key data ever touches the USB key, only signed transactions that will end up in the blockchain anyway.
When people talk about "paper wallets", I believe they're talking about something similar to what you are describing: the private keys are not
held on the offline computer, but instead re-typed every time the offline computer is booted.
Also, when Armory upgrades to BIP 32, it will be possible to compute private key X directly. But the current deterministic algorithm in Armory uses a
real chain: i.e. private key X depends on private key X-1. Therefore, if you need address 132, you have to compute the first 131. Instead, I don't even pass indices between the systems. Armory just precomputes the first 100-1000 addresses and identifies what it is capable of signing in the supplied transaction.