Well, in that scenario, creating intermediate certificates offline, deploying them where needed, securing them with less effort than root but more effort than o

Well, in that scenario, creating intermediate certificates offline, deploying them where needed, securing them with less effort than root but more effort than others, and creating actual certificates to use via the intermediate certificates should be a reasonable approach.