Alright well firstly the PI doesn't need an input QR code unless it needs information from the blockchain/Internet.
For example hardware wallets don't have internet access and have no idea how much crypto they are securing.
All a hardware wallet can do is sign a public operation with the private key (blindly).
On Hive there are variables to make sure you can't post to multiple chains at once so you need to know a valid ref_block_num & ref_block_reference which act as a reference to the current chain you are posting on. The ref_block_num resets every 2^16 (65,536) blocks so you have to pick a reference that is at most 54.6 hours old otherwise it will not be valid by definition and the nature of the 16-bit overflow mechanic.
All this being said if you want airgapped communications and already know your partner's public key for encrypting messages then you don't need additional info from the interwebs. Again all these values can be input by hand, the QR code scanning is just an extreme convenience to avoid needing to type hundreds of characters flawlessly. In a way doing it by hand makes your brain the airgap rather than the QR code.
Output QR code:
The QR code that the PI creates to broadcast to the Internet is scanned by a phone.
The phone piggyback then broadcasts that message to the interwebs.
You can manually read all the data that goes in or out of the PI before it gets exposed.
All outbound transactions have already been encrypted by the private key.
Remember that the main reason to do all of this is to protect the private key.
As long as the key can't get leaked by outbound and the device functions as intended we're good.
RE: Round Robin SHA-256 RNG