How to sign a CRL file if I have offline keys?
At some point your Root CA has to have control over it's subordinate CAs.  If there was a scheme where it delegates this control to another server (such as your OCSP-like suggestion), the Root CA would still need to have control over this service in some way or another.  In order to assert this control you would at some point need to power up the Root CA.  A scheme where the Root CA delegates full control to another service would mean that the Root CA effectively loses control; which is not what you want.

The standard way is to have the Root CA generate long-lifed CRLs.  This is relatively safe as the only certificates it issues are to a very few subordinate CAs and these CAs are (should be) securely operated in accordance with the PKI's Certificate Policy with a statement describing this operation in the CA's Certification Practice Statement.

Therefore, every (for example) six months:


Switch on the Root CA;
Generate a new CRL;
Export the CRL (for example using a CD/DVD burner);
Switch off the Root CA.


This process should be formalised and if you have concerns about someone running away with a copy of your Root CA's private key, your PKI Management Authority can/should insist on the use of witnesses and/or CCTV or any other scheme it deems fit.