Now that I think of it, you don't even need a CNC server, you can make do with a public FTP site. The client will generate a cert, send it to FTP server, an on-

Now that I think of it, you don't even need a CNC server, you can make do with a public FTP site. The client will generate a cert, send it to FTP server, an on-prem app will download it from the FTP, the admin will review the fingerprint and sign the cert with his own key, then the on-prem app will encrypt all secrets with all signed certs and push them back to the FTP server. Substitute FTP for S3/etc as needed.