It is a huge PITA. I recently quit a job where I helped out with a PKI environment that was air-gapped.

We employed a lot of improvised quality of life solutions that management doesn't want to know about.