How can offline transaction signing ever be safe? I'm relativly new to bitcoin and this is one part that I cannot understand.
Lets say I create a transaction at my watching-only wallet. Then I sign it on my offline wallet. That means I just "toggle something"/"add some data that says signed" when I'm signing my transaction at the offline wallet.
Isn't that easily hackable so that everybody can easily sign transactions without knowing the private-key? I mean the watching only wallet has no clue of the private key so there must be some information that is != private-key in the data that comes back from the offline wallet.
Even if I sign it at the online-wallet somebody could just change the sourcecode of the client that he does not need the private-key to sign something.