Just remembered the other common workaround: you can create a secondary SmartCenter object with a different name (e.g, the real management's name with a "-Public" suffix) and the public IP. Don't try to establish SIC. You just want an object to exist with management checked and with the public IP. That will cause the public IP to go into the masters file.
When the gateway tries to connect to the primary management, it will fail because it can't reach the private address, but it doesn't know this (as far as the gateway is concerned, maybe the primary suffered a failure and is shut down). When it tries to connect to the secondary management, it will be able to establish a TCP connection, and the certificate is signed by the certificate authority (since it *is* the certificate authority).
The downside is you will always have a red X in the Gateways & Servers status page, since the management won't ever be able to communicate with the fake object. The biggest benefit is it gives you a lot of control over which firewall talks to which management address, for logging and so on.
SmartCenter objects also have a topology table. Since they don't run the firewall kernel, I'm about 80% sure the table doesn't have any impact on the software running on the SmartCenter itself. It may be possible to add a fake interface there with the public address to get the address into the masters file.
Not sure if either of these options would work for a CMA.
