Idea

online-mode=false servers should always be marked as secure "✅".

If that's not feasible, then preventing whitelisting and adding a custom tooltip for the yellow state would do as well.

Reasoning

online-mode=false servers do not require signatures, even if enforce-secure-profile=true. No player can be reported, whether they are online or offline, NCR or vanilla.

The problem arrives when the player itself is online and attempts to send a signature to the server (e.g. by NCR whitelist). By doing that, they'll get kicked and if they don't know how to manage NCR config, they'll be stuck in a kick loop.
Marking the server as secure would prevent whitelist code from being recommended (in tooltips) and executed in the first place.

If an offline player tries to whitelist the server, they'll not get kicked. Haven't debugged how it works but I'd assume the vanilla code just doesn't attempt to sign offline players either way. Wouldn't hurt to prevent whitelisting even then.

Other Information

1.19.3