See our blog post SSH Emergency Access for instructions on adding offline CAs for emergency access.