Most browsers support trust on first use for leaf certs
Using a browser in an air gapped environment is so much more pain than it should be.
And later if something changes, then they can do the whole DOING SOMETHING NASTY! thing, which is effectively the experience today