But how can it be truly offline? Doesn't the root ca have a list of int cas that it trusts. so therefore when a user goes to a website the chain has to be completed. So there is a query to the root CA there? I'm sure there is an answer somewhere that i'm missing.
An offline root ca setup could look like this:
Create the root CA
This should be done on an PC disconnected from any external network and in most cases is done on an HSM.
This part is sometimes done in public, to prevent anybody from messing with an root ca (https://www.iana.org/dnssec/ceremonies)
Create 1 or more intermediate CA's
For this step, you are still on your air gapped PC, which contains the root CA or is connected to an HSM.
The procedure is the same as for the root ca, except that the intermediate CA's are signed by the root CA.
Exporting the keys
In this step, the CA's certificate is exported onto a disk (for example an previously blank CD).
It's also the step, where the intermediate CA's will be exported (Public & Private key) [Note: If the intermediate CA's, where also generated on HSM's, these can in most cases just be unplugged and transported to there new owners]
Securing the root CA
Now, that the CA generation and export is finished, you can shutdown the root CA PC/HSM and look it away securely.
Publishing the Key
The last step is to distribute the CA certificate. This can be as simple, as publishing it on your website.
Usage in practice
If a new certificate needs to be created, this can be done by the Intermediate CA's.
Any following revocation of these certificates can therefor also be done by those intermediate CA's.
Since these intermediate CA's can also be online (e.g. connected to the internet), it is possible to use them for OCSP.
As you have previously described, it would be possible to create an intermediate CA, only for OCSP/CLR.
Intermediate CA compromise
In case of a compromise, the root CA can powered on, inside it's air gapped environment, and then be used to sign an revocation of the intermediate CA. This revocation certificate can then again be published, by first transferring it via an secure media to an internet connected device.