There are several solutions, and while most are limited to volume licensing, which, depending on your definition, may exclude "regular users", at least one is not:

1. Supply the code given by the "slmgr /dti" command to Microsoft over the phone or online from a non-air gapped machine.

2. Apply the resulting activation code with the "slmgr /atp" command.

The phone option just went away per TFA, which is why I was wondering if there's still an online (but on a different device) way to do this.

Yeah this. The common man rules don't apply there.

Even in Enterprise by the way. No way we pay the amounts listed on the MS website.

I would guess (no idea) that military computers log into the cloud, maybe it is a special (expensive) ms military cloud.

That then is explicitly not an "air gapped" computer, which there definitely is need for in the military and government.

Regular users buy a PC with Windows pre-activated.

You take it to Base Ops and they imaage it or they come to you and image it.