I'm talking my employer's book, but you can approximate this function for sure on Foundation Passport by generating a child seed then loading it as a temporary signing key (forgotten on power off). I'm sure Coldcard offers something similar and perhaps others. Of course, you'd have to remember to delete the seed before putting the device away, and it's derived, not generated from scratch, so undermining some of the security. But it's close, and the desired functionality could be added if there was demand, all the pieces are there.

The upcoming Passport Prime device would be perfectly placed to serve a workflow in a secure environment that generates an ephemeral key, signs, discards, and passes the PSBTs back to the online device. This is niche enough that we're unlikely to write the applet ourselves, but that's why it's an open source platform - hopefully some vault project will come along and assemble the building blocks in the right way; it shouldn't be hard.