I used to have an air gapped master key with a hot subkey that I used for everything besides key attestation. In that setup, dealing with any sort of tooling was a nightmare, so I gave up on it.