For added safety, I would also make sure that your WiFi has a password and that the Switch doesn't have the password. It wouldn't protect against other WiFi networks, or mobile hotspots, but it would be a layer of protection. The kid could disable Stealth mode, but without knowing the WiFi password can't go online.
For some games, turning off WiFi can break things. For example, we can't play Minecraft split-screen unless WiFi is turned on for some strange reason, and both profiles have to have been connected to a Nintendo account online at some point, so we have to turn off airplane mode in order to play even offline which is all the more reason to keep the Switch from knowing the WiFi password and keeping it in Stealth mode.
Now that emuNAND is on the microSD card, I do feel like it will eventually be (mostly) safe to go online in sysNAND OFW, keeping Homebrew and backups on the CFW and games for playing online handy for inserting, so at some point in the future I will take the Switch online and basically use the combination of Stealth Mode and WiFi passwords to separate the modes of play, but if a ban ever does happen I know it will be much more difficult to find a hackable Switch. For that reason I would also love to have a way of changing the console keys, although just changing them wouldn't be enough because then the NAND would act like someone restored the NAND from a different switch. We'd need a way to both change the console keys and also change the NAND backups to work with the new keys.
What you could do is purchase a used banned Switch. Unfortunately, most people aren't going to advertise the console as banned and Nintendo would never unban one you bought even if you didn't know when buying, but it would probably be cheaper to buy one that is already banned and let a kid have that rather than taking the risk and trying to find a new hackable Switch later.