The keys are on a HSM, but something has to nicely ask the HSM to do things and an air-gapped laptop feels like a pretty sensible choice? (Especially given the precautions we've talked about)