How can I sign raw transaction generated by truffle?

Question

I can create tokens by the following way. However, I want to sign raw transaction generated by truffle so that I don't need to store my private key online. How can I get raw unsigned transaction?

$ mkdir /tmp/zonotoken-infra
$ cd /tmp/zonotoken-infra
$ truffle unbox tutorialtoken
$ npm install ethereumjs-wallet bip39 web3-provider-engine@8.6.1 web3@0.18.4 zeppelin-solidity --save
$ vi ./truffle.js
$ vi ./contracts/ZonoToken.sol
$ vi ./migrations/2_deploy_contracts.js
$ truffle compile
$ truffle deploy --network ropsten

./truffle.js

var bip39 = require("bip39");
var hdkey = require('ethereumjs-wallet/hdkey');
var ProviderEngine = require("web3-provider-engine");
var WalletSubprovider = require('web3-provider-engine/subproviders/wallet.js');
var Web3Subprovider = require("web3-provider-engine/subproviders/web3.js");
var Web3 = require("web3");
var FilterSubprovider = require('web3-provider-engine/subproviders/filters.js');

// Get our mnemonic and create an hdwallet
var mnemonic = "xxxxxxxxxxxxxxxxxxxxxxx";
var hdwallet = hdkey.fromMasterSeed(bip39.mnemonicToSeed(mnemonic));

// Get the first account using the standard hd path.
var wallet_hdpath = "m/44'/60'/0'/0/";
var wallet = hdwallet.derivePath(wallet_hdpath + "0").getWallet();
var address = "0x" + wallet.getAddress().toString("hex");

var providerUrl = "https://testnet.infura.io";
var engine = new ProviderEngine();
engine.addProvider(new FilterSubprovider());
engine.addProvider(new WalletSubprovider(wallet, {}));
engine.addProvider(new Web3Subprovider(new Web3.providers.HttpProvider(providerUrl)));
engine.start(); // Required by the provider engine.

module.exports = {
  networks: {
    "ropsten": {
      network_id: 3,    // Official ropsten network id
      provider: engine, // Use our custom provider
      from: address,    // Use the address we derived
      gas: 4600000
    }
  },
  rpc: {
    // Use the default host and port when not using ropsten
    host: "localhost",
    port: 8545
  }
};

./contracts/ZonoToken.sol

pragma solidity ^0.4.4;
import 'zeppelin-solidity/contracts/token/StandardToken.sol';

contract ZonoToken is StandardToken {
  string public name = 'ZONO';
  string public symbol = 'ZONO';
  uint public decimals = 0;
  uint public INITIAL_SUPPLY = 100;

  function ZonoToken() {
    totalSupply = INITIAL_SUPPLY;
    balances[msg.sender] = INITIAL_SUPPLY;
  }
}

./migrations/2_deploy_contracts.js

var ZonoToken = artifacts.require("./ZonoToken.sol");

module.exports = function(deployer) {
  deployer.deploy(ZonoToken);
};