There's a very fine line between there network, the internet, and your
network.  It's all about permissions and routing.
That said, you can do the same things that you can do on your network,
depending on network configuration. Typically, you have to be able to
contact the RA or the CA (often both) to figure out revocation etc.
Otherwise, what would be the point right?  That's not often allowed, but
instead folks use a trusted third-party CA such as Thawte, Verisign, etc.

There are other ways as well.  Have you seen what Tumbleweed products can
for you for example? Individual credentials for s/mime or PGP?

Al