The manual describes an offline-root kit: deliberately database-free, its whole state one signed, encrypted bundle, exchanging signed request/response packages with the online estate. It is a good design. It is also not in this release.
Roadmap — designed, not built. No root binary or signed media exists yet; there is nothing to install from today. The manual says this itself, where you would act on it.
What you can do today for a high-assurance root, honestly stated:
- Keep the root outside goca.
externalParent: true(frame 33) chains your issuing CAs under your existing ceremony-grade system — the root never touches goca at all. - Run a dedicated
GOCA_MODE=root-cainstance (frame 34) — and be precise about what that is: a normal database-backed instance that refuses leaf issuance and brands itself. It is not an air-gapped, file-in/file-out kit, and calling it one would be exactly the blur this product refuses elsewhere.
A vendor that tells you which of its own features don't exist yet is telling you something about how it will describe everything else. Plan your root on what ships; put the kit on your roadmap where goca puts it on theirs.
Now I can say what an offline root looks like today — and what is still roadmap.