I did it this way:
- Backed up save from hacked console with Checkpoint
- Put legit console in flight mode
- Take NAND backup
- Boot into CFW and restore save(s) with Checkpoint
- Take another NAND backup
- Open the save-injected NAND backup with hacdiskmount
- Copy the specific (console signed) save files for the games I want (I didn't copy them all)
- Open the original NAND backup with hacdiskmount
- Overwrite the existing saves with the new ones
- Restore the original NAND backup, which is essentially the same, except for the 1 or 2 save files you've replaced.
There should be no evidence that CFW was ever run, as it never was under the original NAND backup.
No files should have changed except for the save files you replaced, which are properly signed by your console/Horizon.
Unless Nintendo stores some kind of metadata to detect that the save file(s) have been modified since the last shutdown and current boot-up (which they may), it should be pretty safe (and if they don't already do that they'll know after reading this...). It's the safest way I can think to do it, however it's certainly not ban proof.
LibHac is also able to sign saves, I also did it successfully for a modified save, it requires a bucketload of C# knowledge though currently.