Installing custom Elasticsearch plugins in Elastic Cloud

Yes, what you said makes total sense. And having two clusters in CCS is equally good, if not even better in term of separation of concerns.

We can keep all the data in the Elastic Cloud, and we can have a tiny ~empty cluster configured to cross-cluster search to the Cloud one, and from there we are just going to refer to indices as "cloud_cluster:index_xyz" instead of "index_xyz".

If this is ok for you, I think this is the way forward. So the only knot remaining here is the very "practical" format issue in the cert exchange, as I talked about in my other topic.