To be very clear, I have used myetherwallet offline to send eth many times in the past. I went through the code for the version I saved and found no Maliciously code. Hypothetical for future development, not accusatory for recent version (at least not for the one I used, v3.21.0) I even started to modify their code to I can automate my own way of signing multiple transactions hash into a file. FYI, you can broadcast the signed transaction hash via etherscan.io api, so there is no need to use step 3 referred by MEW. First, I perform everything related to ethereum offline in a dedicated PC that never saw internet. The only way to move data is via a USB thumb drive between computers. I spent very large amount of time to examine the security holes in very step alone the way. Most of them I have control except a few I have doubt: Since user need to provide the private key to sign the transaction of sending ether, and one transtion parameter/arugement/field is DATA (optional), it can be code for smart contract or a text message like "hello world". Can myetherwallet developer encrypt your private key with their own key and put it as a message string into this field so it would be part of signed hash broadcasted to the internet (only them can decryt that on the blockchain)? This question applies to all hardware wallet as well because they use similar way to sign transactions. I know MEW is open source, but I doubt even the most advance security expert read source code every time when they use MEW offline. I supposed you can save a copy of known good MEW offline and using it for as long as you can (This is what I did). But there is no gurauntee the known good copy you saved can be used forever. Are you going to read source code everytime you update? probably not, so how can you trust MEW / any hardware wallet vendor not trying to steal your private key?
Can myetherwallet developer encrypt your private key with their own key and put it as a message string into this field so it would be part of signed hash broadcasted to the internet (only them can decryt that on the blockchain)?
Yes. They could do that. In order to check that they have not done this, you can learn to read the Ethereum transaction format and how the fields are encoded to verify that that is not the case, or you could use a tool for that such as ethereum-tx-decoder in npm. This tool will reveal the content of the signed transaction and you could in this way check that there is no redundant information in the transaction.
If you want to use an online tool for this service, you can use RunKit + npm with the ethereum-tx-decoder package. You can look at my example for a standard Ethereum transaction with an empty data field here: https://runkit.com/sword-smith/5ace0061aaa1c70012a8844b
If you want to learn how Ethereum transactions are encoded, see Section 4.3 in the Ethereum Yellow Paper.
I got it work https://www.npmjs.com/package/ethereumjs-tx https://npm.runkit.com/ethereumjs-tx serializedTx.toString('hex') would output the raw transaction. Make sure you download everything run the code offline since you need to sign transaction with your private key. If you just want to verify MEW's raw transaction, you can generate some random public/private key pair to test. Then the whole operation can perform online since nothing in the test has money involved.