An air gap is not a setting but a physical fact: there is no path from the machine to any network. A private key can only leave a machine if something carries it, so removing every carrier shrinks the attack surface to whoever can physically touch the box. It does nothing about a bad paper backup or what you sign once back online, so it is one good, narrow control.