How about using the scep daemon without a local CA? Instead plugins could be used to actually issue certificates, i.e. requesting and fetching the cert from a remote CA (that does not support scep).