CSRs, signed certs, certificate transparency log entries, revocations etc have to get between the signing device and public some how. You can create a gap, but then you have to bridge it somehow for this data.
Do you want an organization that prints out and types in every request going across that gap? You're probably not going to find that.
Is there any of this that could not be done on a daily basis?
Requests go on a memory card at the end of the day, onto the signing device which signs them for a year, back on the card and onto the network-connected device from where they are mailed back to the customer.
What functions of a CA have to be run more frequently than this?
CA Baseline requirements say certificate revocation must be within 24h so a daily process may miss; a manual process on-demand or every 12hours would comply.
I suspect it's more about competitiveness though. Manual processes are expensive and slow, which likely will push customers to choose other CAs. I don't think there is a market for manually operated certificates. I believe this for two reasons:
1. Because any CA can issue a certificate, you are exposed to the risk of some other CA getting hacked regardless of how secure the CA you choose is. (Although CT and CAA may mitigate this).
2. Air-gapping is neither necessary nor sufficient to be secure. Not sufficient because even an air-gapped system needs controls against insider threats, tampering of data before it gets transfered across the air-gap, attacks that breach the air-gap [1] etc. Not necessary because well run systems can be reasonably secure even without an air-gap.
There is no threat model, just curiosity, but obviously if the signing device is online then its signing key could potentially be retrieved by an attacker on the Internet.
The CA/B baseline requirements include storage of the private key on a FIPS 140 Level 3 cryptographic device (i.e. an HSM) so there's a certain minimum degree of assurance there.
