Malware on a daily computer can show you one address and swap in another when the payment is built, so the machine that holds the keys should be the one you read the destination from. XColdPro is built for that path: you check and sign offline, then move the signed payment back to a computer that is allowed to talk to the network. Details are at xcoldpro.com.