Devil's Advocate:

What if they swap Scheier's USB key (or drive) with one that will exploit the USB stack on his offline computer (disabling 'auto-mount' won't help you here)?

Yes, it's a physical access attack, but physical access to his person might be easier to achieve (while remaining unnoticed) than access to the offline computer.

I think the idea is to use simple physical media, like CDROM, where hiding a malicious payload is far more difficult since there's no embedded electronics on a disc.

If that's too cumbersome, one could always implement a simple teletype-like system with a low bitrate. Like an automatic machine that can physically press keys on a keyboard. Then remove every key except letters, numbers, shift and tab.

You could use a similar system or OCR to get data off the gapped machine.

One could, but IIRC Schneier has mentioned using a USB drive (though it could all be a clever ruse to throw off the NSA ;-).

And he's probably high enough in the list of NSA "persons of interest" to warrant a field agent's time.

How would you decrypt the message? The only safe option would be to print out the encoded message, and retype it into the offline computer. I don't think anyone does that.

Also, the offline computer can be physically compromised.